teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1

Retain GCP readiness workflow artifacts
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details

Browse source
This commit is contained in:
twentyOne2x 2026-07-07 12:47:29 +02:00 committed by GitHub
parent 0c9dde3f36
commit 04e586c23e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 26 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
.github/workflows/gcp-readiness.yml vendored
View file

@ -15,6 +15,7 @@ env:
PROJECT_ID: teleo-501523 PROJECT_ID: teleo-501523
WORKLOAD_IDENTITY_PROVIDER: projects/785938879453/locations/global/workloadIdentityPools/github-actions/providers/living-ip-github WORKLOAD_IDENTITY_PROVIDER: projects/785938879453/locations/global/workloadIdentityPools/github-actions/providers/living-ip-github
ARTIFACT_SERVICE_ACCOUNT: sa-artifact-builder@teleo-501523.iam.gserviceaccount.com ARTIFACT_SERVICE_ACCOUNT: sa-artifact-builder@teleo-501523.iam.gserviceaccount.com
READINESS_ARTIFACT_DIR: gcp-readiness-artifacts
jobs: jobs:
readiness: readiness:
@ -36,31 +37,33 @@ jobs:
shell: bash shell: bash
run: | run: |
set +e set +e
mkdir -p .gcp-readiness mkdir -p "${READINESS_ARTIFACT_DIR}"
{ {
echo "project=${PROJECT_ID}" echo "project=${PROJECT_ID}"
echo "service_account=${ARTIFACT_SERVICE_ACCOUNT}" echo "service_account=${ARTIFACT_SERVICE_ACCOUNT}"
echo "workflow_ref=${GITHUB_REF}" echo "workflow_ref=${GITHUB_REF}"
echo "revision=${GITHUB_SHA}" echo "revision=${GITHUB_SHA}"
} > .gcp-readiness/context.txt } > "${READINESS_ARTIFACT_DIR}/context.txt"
gcloud auth list --format=json > .gcp-readiness/gcloud-auth-list.json 2> .gcp-readiness/gcloud-auth-list.stderr gcloud auth list --format=json > "${READINESS_ARTIFACT_DIR}/gcloud-auth-list.json" 2> "${READINESS_ARTIFACT_DIR}/gcloud-auth-list.stderr"
echo "$?" > .gcp-readiness/gcloud-auth-list.exitcode echo "$?" > "${READINESS_ARTIFACT_DIR}/gcloud-auth-list.exitcode"
gcloud config list --format=json > .gcp-readiness/gcloud-config-list.json 2> .gcp-readiness/gcloud-config-list.stderr gcloud config list --format=json > "${READINESS_ARTIFACT_DIR}/gcloud-config-list.json" 2> "${READINESS_ARTIFACT_DIR}/gcloud-config-list.stderr"
echo "$?" > .gcp-readiness/gcloud-config-list.exitcode echo "$?" > "${READINESS_ARTIFACT_DIR}/gcloud-config-list.exitcode"
- name: Run readiness checker - name: Run readiness checker
shell: bash shell: bash
run: | run: |
set +e set +e
mkdir -p "${READINESS_ARTIFACT_DIR}"
python3 ops/check_gcp_infra_readiness.py \ python3 ops/check_gcp_infra_readiness.py \
> .gcp-readiness/gcp-infra-readiness.json \ > "${READINESS_ARTIFACT_DIR}/gcp-infra-readiness.json" \
2> .gcp-readiness/gcp-infra-readiness.stderr 2> "${READINESS_ARTIFACT_DIR}/gcp-infra-readiness.stderr"
echo "$?" > .gcp-readiness/gcp-infra-readiness.exitcode echo "$?" > "${READINESS_ARTIFACT_DIR}/gcp-infra-readiness.exitcode"
python3 - <<'PY' python3 - <<'PY'
import os
import json import json
from pathlib import Path from pathlib import Path
base = Path(".gcp-readiness") base = Path(os.environ["READINESS_ARTIFACT_DIR"])
report = { report = {
"artifact": "github_wif_gcp_readiness_probe", "artifact": "github_wif_gcp_readiness_probe",
"checker_exitcode": (base / "gcp-infra-readiness.exitcode").read_text().strip(), "checker_exitcode": (base / "gcp-infra-readiness.exitcode").read_text().strip(),
@ -94,5 +97,5 @@ jobs:
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v4
with: with:
name: gcp-readiness name: gcp-readiness
path: .gcp-readiness/ path: ${{ env.READINESS_ARTIFACT_DIR }}/
if-no-files-found: error if-no-files-found: error

3
ops/check_gcp_infra_readiness.py
View file

@ -270,6 +270,7 @@ def check_github_actions_readiness_ci() -> Check:
"google-github-actions/auth@v2", "google-github-actions/auth@v2",
"ops/check_gcp_infra_readiness.py", "ops/check_gcp_infra_readiness.py",
GITHUB_ARTIFACT_SERVICE_ACCOUNT, GITHUB_ARTIFACT_SERVICE_ACCOUNT,
"READINESS_ARTIFACT_DIR: gcp-readiness-artifacts",
"gcp-readiness-summary.json", "gcp-readiness-summary.json",
"actions/upload-artifact@v4", "actions/upload-artifact@v4",
] ]
@ -285,7 +286,7 @@ def check_github_actions_readiness_ci() -> Check:
return Check( return Check(
"github_actions_readiness_ci", "github_actions_readiness_ci",
"pass", "pass",
"workflow=.github/workflows/gcp-readiness.yml captures readiness stdout/stderr/exitcode through GitHub WIF", "workflow=.github/workflows/gcp-readiness.yml captures readiness stdout/stderr/exitcode through GitHub WIF in a non-hidden artifact directory",
required_tier="T3_live_readonly", required_tier="T3_live_readonly",
current_tier="T2_runtime", current_tier="T2_runtime",
) )

10
tests/test_gcp_readiness_workflow.py Normal file
View file

@ -0,0 +1,10 @@
from pathlib import Path
def test_gcp_readiness_workflow_uses_uploadable_artifact_dir() -> None:
workflow = Path(".github/workflows/gcp-readiness.yml").read_text()
assert "READINESS_ARTIFACT_DIR: gcp-readiness-artifacts" in workflow
assert 'mkdir -p "${READINESS_ARTIFACT_DIR}"' in workflow
assert "path: ${{ env.READINESS_ARTIFACT_DIR }}/" in workflow
assert "path: .gcp-readiness/" not in workflow