Repository navigation
Use STRR API IAM helper for jobs and queues - #1764
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Collaborator
Author
|
CI container builds could not fetch the companion commit from the upstream repository before bcgov/sbc-connect-common#77 merges, so the dependency is now pinned to the exact commit on my fork. Once the companion PR merges, I will switch the source URL back to bcgov before this PR is merged. |
There was a problem hiding this comment.
🔵 Needs a closer look
Warning
- Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.
Pull request overview
Migrates ten STRR services and jobs to shared Cloud SQL IAM authentication while preserving local database configuration.
Changes:
- Adopts the shared Cloud SQL connector and regenerates dependency locks.
- Updates deployment vault mappings and the email sandbox region.
- Adds deployment contract tests, CI coverage, and Sonar exclusions.
File summaries
| File | Description |
|---|---|
.github/workflows/strr-gcp-iam-deployment-contracts-ci.yaml |
Runs IAM deployment contract checks. |
.sonarcloud.properties |
Excludes duplicated job configuration. |
jobs/auto-approval/.env.sample |
Excluded by policy. |
jobs/auto-approval/devops/vaults.gcp.env |
Maps job IAM database settings. |
jobs/auto-approval/poetry.lock |
Locks connector dependencies. |
jobs/auto-approval/pyproject.toml |
Adds the shared connector. |
jobs/auto-approval/src/auto_approval/config.py |
Uses shared SQLAlchemy settings. |
jobs/auto-approval/tests/unit/test_config_cloudsql_iam.py |
Tests connector wiring. |
jobs/batch-permit-validator/.env.sample |
Excluded by policy. |
jobs/batch-permit-validator/devops/vaults.gcp.env |
Maps job IAM database settings. |
jobs/batch-permit-validator/poetry.lock |
Locks connector dependencies. |
jobs/batch-permit-validator/pyproject.toml |
Adds the shared connector. |
jobs/batch-permit-validator/src/batch_permit_validator/config.py |
Uses shared SQLAlchemy settings. |
jobs/interactions-update/.env.sample |
Excluded by policy. |
jobs/interactions-update/devops/vaults.gcp.env |
Maps job IAM database settings. |
jobs/interactions-update/poetry.lock |
Locks connector dependencies. |
jobs/interactions-update/pyproject.toml |
Replaces the direct connector dependency. |
jobs/interactions-update/src/interactions_update/database.py |
Prioritizes shared IAM settings. |
jobs/interactions-update/tests/unit/test_database.py |
Updates missing-configuration coverage. |
jobs/interactions-update/tests/unit/test_database_cloud.py |
Tests IAM creator and pool wiring. |
jobs/noc_expiry/.env.sample |
Excluded by policy. |
jobs/noc_expiry/devops/vaults.gcp.env |
Maps job IAM database settings. |
jobs/noc_expiry/poetry.lock |
Locks connector dependencies. |
jobs/noc_expiry/pyproject.toml |
Adds the shared connector. |
jobs/noc_expiry/src/noc_expiry/config.py |
Uses shared SQLAlchemy settings. |
jobs/provisional-approval/.env.sample |
Excluded by policy. |
jobs/provisional-approval/devops/vaults.gcp.env |
Maps job IAM database settings. |
jobs/provisional-approval/poetry.lock |
Locks connector dependencies. |
jobs/provisional-approval/pyproject.toml |
Adds the shared connector. |
jobs/provisional-approval/src/provisional_approval/config.py |
Uses shared SQLAlchemy settings. |
jobs/registration_expiry/.env.sample |
Excluded by policy. |
jobs/registration_expiry/devops/vaults.gcp.env |
Maps job IAM database settings. |
jobs/registration_expiry/poetry.lock |
Locks connector dependencies. |
jobs/registration_expiry/pyproject.toml |
Adds the shared connector. |
jobs/registration_expiry/src/registration_expiry/config.py |
Uses shared SQLAlchemy settings. |
jobs/renewal-reminders/.env.sample |
Excluded by policy. |
jobs/renewal-reminders/devops/vaults.gcp.env |
Maps job IAM database settings. |
jobs/renewal-reminders/poetry.lock |
Locks connector dependencies. |
jobs/renewal-reminders/pyproject.toml |
Adds the shared connector. |
jobs/renewal-reminders/src/renewal_reminders/config.py |
Uses shared SQLAlchemy settings. |
jobs/strr-backfiller/devops/vaults.gcp.env |
Maps job IAM database settings. |
jobs/strr-backfiller/poetry.lock |
Locks connector dependencies. |
jobs/strr-backfiller/pyproject.toml |
Adds the shared connector. |
jobs/strr-backfiller/src/backfiller/config.py |
Uses shared SQLAlchemy settings. |
queue_services/strr-email/.env.sample |
Excluded by policy. |
queue_services/strr-email/devops/gcp/clouddeploy.yaml |
Corrects the sandbox database region. |
queue_services/strr-email/devops/vaults.gcp.env |
Maps service IAM database settings. |
queue_services/strr-email/poetry.lock |
Locks updated dependencies. |
queue_services/strr-email/pyproject.toml |
Pins the shared connector. |
queue_services/strr-email/src/strr_email/config.py |
Uses shared production and test settings. |
queue_services/strr-email/tests/unit/test_config_cloudsql_iam.py |
Tests connector wiring. |
queue_services/strr-pay/.env.sample |
Excluded by policy. |
queue_services/strr-pay/devops/vaults.gcp.env |
Maps service IAM database settings. |
queue_services/strr-pay/poetry.lock |
Locks updated dependencies. |
queue_services/strr-pay/pyproject.toml |
Pins the shared connector. |
queue_services/strr-pay/src/strr_pay/config.py |
Uses shared SQLAlchemy settings. |
tests/deployment/test_gcp_iam_vaults.py |
Validates mappings, identities, and region. |
Review details
Files excluded by content exclusion policy (9)
- jobs/auto-approval/.env.sample
- jobs/batch-permit-validator/.env.sample
- jobs/interactions-update/.env.sample
- jobs/noc_expiry/.env.sample
- jobs/provisional-approval/.env.sample
- jobs/registration_expiry/.env.sample
- jobs/renewal-reminders/.env.sample
- queue_services/strr-email/.env.sample
- queue_services/strr-pay/.env.sample
- Files reviewed: 38/57 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
jimmypalelil
approved these changes
Oct 1, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Use the STRR API Cloud SQL helper for IAM connections in eight jobs and the email/payment queues. Cloud Run requires IAM. Local/test drivers and the API's runtime configuration stay unchanged.
Keep the existing API GitHub dependency, API unit-test CI and SRE deployment workflows; remove the separate helper package, scripts and deployment-test workflow and its tests to reduce maintenance.
Temporarily pin the API dependency so consumers can install the helper before it reaches main. After merge, switch back to main and refresh lockfiles in a small follow-up.