test: add protected DEV IAM catalog verification

[Jacky-Pham]

DEV runtime metadata and local mocks do not establish a successful Cloud SQL IAM login or effective database grants. Add a manual verifier using the existing STRR GitHub → tools Cloud Build route and the actual shared connector for the fixed DEV API/job identities.

PRs run offline checks only. The cloud job requires manual dispatch from protected bcgov/STRR main in the existing DEV environment. It checks the WIF/account route and actual worker identity, uses 600-second impersonated credentials, then reads database identity, server/extension versions and catalog privileges in a read-only transaction. Output contains allowlisted metadata/error classes; loginVerified and conservative writeCatalogReady are separate, and consumersVerified remains false. No business rows, product jobs, SQL writes, grants, deployment commands or arbitrary target/ref inputs are exposed.

The validation job has no cloud credentials or OIDC permission. It builds the commit/hash-pinned common helper into a fixed directory, verifies its connector module, tests the wheel and uploads it with a checksum manifest. The cloud job takes only that immutable same-run artifact, validates its identity/checksum and embeds it in a no-source build. All 31 registry dependencies are version/hash locked and installed as wheels; the cloud build performs no source-package builds. The Python image and Google auth/setup actions are pinned by digest/commit.

Review gates

• Review/merge feat(cloud-sql): centralize environment settings sbc-connect-common#77, then repin to its official merge commit before merging this workflow.
• DEV job write privileges remain a separate owner decision in Allow STRR DEV jobs to write through IAM database user bcregistry-sre#400. Successful login does not satisfy the catalog gate when required privileges are absent.
• Review and merge through protected main before an authorized owner runs the manual check. This PR has not submitted a Cloud Build, impersonated a live identity or connected to Cloud SQL.

Validation

• Thirteen unit tests pass locally and in the pinned Linux amd64 image with networking disabled, using the actual installed helper and mocked cloud/database boundaries. Image source hashes match this checkout.
• Tests cover wrong helper/worker/database identity, missing privileges, empty schema, row security, partial impersonation failure, cleanup/diagnostic redaction, wheel tampering and unexpected artifact filenames.
• The actual catalog-reading function and all six SQL queries pass against disposable PostgreSQL18.6 in a read-only transaction, including rollback. This is local SQL validation, not live IAM evidence.
• Actionlint, Black, generated JSON/bash syntax and diff checks pass.

Final CI

At c242846a, all checks are terminal: seven successes, five neutral frontend checks and the intentionally skipped live verify job. Offline validation, all CodeQL languages and Sonar pass; Sonar reports zero issues. Validation run, CodeQL run.

Related: #1763, #1764, #1853.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud