REGBACKLOG-336: manage DEV storage and eventing in application workflows - #1790
Open
Jacky-Pham wants to merge 7 commits into
Open
REGBACKLOG-336: manage DEV storage and eventing in application workflows#1790Jacky-Pham wants to merge 7 commits into
Jacky-Pham wants to merge 7 commits into
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Jacky-Pham
marked this pull request as ready for review
August 25, 2026 21:02
bolyachevets
approved these changes
Aug 25, 2026
Collaborator
Author
|
hey Jimmy, the SRE IAM changes are merged and applied now. when you have a chance can you review this so I can run the terraform plan? |
There was a problem hiding this comment.
🟡 Changes recommended
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds dev-only Terraform management for existing STRR Pub/Sub and Eventarc infrastructure.
Changes:
- Defines and imports existing dev resources.
- Configures remote state and keyless authentication.
- Adds manual Terraform plan/apply automation.
File summaries
| File | Description |
|---|---|
terraform/versions.tf |
Configures Terraform, provider, and backend. |
terraform/variables.tf |
Defines dev infrastructure inputs. |
terraform/README.md |
Documents scope and rollout. |
terraform/pubsub.tf |
Manages and imports Pub/Sub resources. |
terraform/eventarc.tf |
Manages and imports the Eventarc trigger. |
terraform/dev.tfvars |
Supplies dev environment values. |
terraform/data.tf |
Resolves the Pub/Sub service agent. |
terraform/.terraform.lock.hcl |
Locks the Google provider. |
.gitignore |
Excludes Terraform working directories. |
.github/workflows/strr-terraform.yaml |
Adds manual plan/apply automation. |
Review details
Files not reviewed (1)
- terraform/.terraform.lock.hcl: Generated file
- Files reviewed: 8/10 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+69
to
+71
| - name: Terraform apply | ||
| if: inputs.action == 'apply' | ||
| run: terraform apply -input=false -auto-approve tfplan |
Jacky-Pham
changed the title
| @@ -0,0 +1,22 @@ | |||
| resource "google_storage_bucket" "registration_documents" { | |||
| @@ -0,0 +1,45 @@ | |||
| resource "google_storage_bucket" "bulk_validation_requests" { | |||
| } | ||
| } | ||
|
|
||
| resource "google_storage_bucket" "bulk_validation_responses" { |
| @@ -0,0 +1,22 @@ | |||
| resource "google_storage_bucket" "registration_documents" { | |||
| @@ -0,0 +1,45 @@ | |||
| resource "google_storage_bucket" "bulk_validation_requests" { | |||
| } | ||
| } | ||
|
|
||
| resource "google_storage_bucket" "bulk_validation_responses" { |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
STRR's DEV buckets and eventing resources currently sit outside the application deployment workflows. This change gives uploads, email, and bulk validation separate Terraform roots and state prefixes, and runs the relevant root automatically before protected-main DEV deployments.
The roots adopt 15 existing resources: the three core buckets, email messaging/DLQ resources, and the validation trigger and callback/DLQ resources. Both validation workflows share one queued execution group and state. Existing bucket access protections, recovery settings, endpoints, and delivery policies are preserved; Eventarc retains ownership of its generated transport resources.
The first plan for each root must contain only unchanged imports (API 1, email 6, validation 8). Later automatic plans allow DEV creation/updates but reject deletion/replacement. The workflow applies the exact saved plan checked by the policy. Infrastructure failures block app deployment, and DEV-only file changes cannot trigger TEST/PROD promotion. Other environments remain outside Terraform's scope.
Dependency before merge
bcregistry-sre #399 must be reviewed and applied through the SRE
devworkspace first. It grants the infrastructure identity only metadata get/update on the three existing DEV buckets. The original WIF/state bootstrap PRs #386/#387 are already merged. Merging this STRR PR starts automatic DEV adoption.Security review before merge
Sonar's quality gate remains blocked by six findings on the existing bucket configuration: three for logging (
terraform:S6258) and three for Object Versioning (terraform:S6412). These definitions preserve current settings for unchanged imports. No finding or rule has been suppressed or dismissed.auditConfigsand the current identity cannot read inherited policy. SRE needs to verify effective Cloud Storage Data Access logging; its presence is not established by these tests.Jacky and Jimmy should review these existing settings and decide the findings' disposition before merge. Any required hardening needs an explicit rollout that preserves the initial import-only policy. The plan-checker path-handling finding has been fixed by consuming Terraform JSON through standard input.
Validation
concurrency.queue; only that diagnostic was suppressed.queue: maxis supported by current GitHub documentation.A full live API/validation plan remains dependent on the new bucket permissions; recorded-metadata tests are not a substitute for that live permission/drift check. The runtime workflow enforces the import-only requirement before its first apply. The state bucket was empty when inspected on September 9; verify no other state has adopted these resources before rollout.
Ticket: REGBACKLOG-336.