36fe0d3cc2
Some checks are pending
CI / lint-and-test (push) Waiting to run
Merge the T2 readiness and least-privilege staging gate. This does not deploy Cloud Run, mutate Cloud SQL, or change production routing.
91 lines
3.4 KiB
JSON
91 lines
3.4 KiB
JSON
{
|
|
"schema": "livingip.observatoryReadAdapterOidcReadinessReceipt.v1",
|
|
"status": "partial_oidc_t2",
|
|
"required_runtime_tier": "T3_live_gcp_staging_api",
|
|
"current_runtime_tier": "T2_authenticated_github_oidc_partial_inventory",
|
|
"workflow": {
|
|
"run_id": 29389090997,
|
|
"url": "https://github.com/living-ip/teleo-infrastructure/actions/runs/29389090997",
|
|
"revision": "33399bd9acfa09e4e5409873e86c8c46ac694a8d",
|
|
"ref": "refs/heads/main",
|
|
"identity": "sa-artifact-builder@teleo-501523.iam.gserviceaccount.com",
|
|
"wif_authentication": "pass",
|
|
"gcloud_setup": "pass",
|
|
"checker_execution": "pass",
|
|
"artifact_upload": "pass",
|
|
"credential_cleanup": "pass",
|
|
"job_conclusion": "failure_due_to_blocked_readiness_enforcement"
|
|
},
|
|
"summary": {
|
|
"pass_count": 8,
|
|
"blocked_count": 10,
|
|
"fail_count": 0,
|
|
"passed_checks": [
|
|
"artifact_repositories",
|
|
"cloud_build_contract",
|
|
"github_actions_readiness_ci",
|
|
"gcp_cloudsql_restore_drill_contract",
|
|
"canonical_postgres_restore_contract",
|
|
"local_canonical_postgres_restore_preflight",
|
|
"gcp_runtime_baseline_contract",
|
|
"gcp_service_communications_contract"
|
|
],
|
|
"permission_or_resource_read_blocks": [
|
|
{
|
|
"check": "cloud_build_service_account",
|
|
"missing_permission": "iam.serviceAccounts.get"
|
|
},
|
|
{
|
|
"check": "github_actions_artifact_ci",
|
|
"missing_permission": "iam.workloadIdentityPoolProviders.get"
|
|
},
|
|
{
|
|
"check": "network_ingress",
|
|
"missing_permission": "compute.firewalls.list"
|
|
},
|
|
{
|
|
"check": "compute_runtime_service_accounts",
|
|
"missing_permission": "compute.instances.list"
|
|
},
|
|
{
|
|
"check": "compute_disk_snapshots",
|
|
"missing_permission": "compute.resourcePolicies.get"
|
|
},
|
|
{
|
|
"check": "backup_buckets",
|
|
"missing_permission": "bucket metadata read denied; exact permission was not retained by the checker"
|
|
},
|
|
{
|
|
"check": "cloud_sql_standby_target",
|
|
"missing_permission": "Cloud SQL instance read denied or target invisible to this identity"
|
|
},
|
|
{
|
|
"check": "kb_source_restore_access",
|
|
"missing_permission": "secretmanager.secrets.list"
|
|
}
|
|
],
|
|
"evidence_blocks": [
|
|
"local_sqlite_postgres_restore_canary",
|
|
"kb_restore_or_replication"
|
|
]
|
|
},
|
|
"security_readback": {
|
|
"artifact_builder_deploy_authorized": false,
|
|
"cloud_run_service_created": false,
|
|
"cloud_sql_queried": false,
|
|
"secret_values_logged": false,
|
|
"production_or_vercel_routing_changed": false
|
|
},
|
|
"source_artifact": {
|
|
"github_run_url": "https://github.com/living-ip/teleo-infrastructure/actions/runs/29389090997",
|
|
"artifact_name": "gcp-readiness",
|
|
"summary_sha256": "6a1be356c069b8affacc492ac3b1e1ca63b917f92a32d7d886511a226c52925b",
|
|
"checker_sha256": "56ce4e8ba655a47e6e620a2c7039ee54fa10b1c53431d1dc6ec4db5189bb17f5",
|
|
"local_download_path": "/private/tmp/observatory-read-adapter-oidc-29389090997/gcp-readiness"
|
|
},
|
|
"proof_paths": [
|
|
"docs/reports/observatory-read-adapter/gcp-oidc-readiness-29389090997-redacted.json",
|
|
"https://github.com/living-ip/teleo-infrastructure/actions/runs/29389090997"
|
|
],
|
|
"claim_ceiling": "GitHub OIDC and the artifact-only identity work. The receipt does not prove broad GCP inventory, adapter prerequisites, a live Cloud Run service, or a teleo_canonical query."
|
|
}
|