[soulbah]

Exercise six Rootform Action entrypoints from a public external repository, using the exact published CLI 0.1.0-pr.117.1 and public synthetic fixtures. Five native platforms verify installation, Form reuse, comparisons, Policy gates and actual artifact inventories; separate jobs prove exact external source cache restoration offline and integrated serialized PR reporting.

Local validation: actionlint, Node script syntax, eight real published-CLI integration cases and isolated TLS registry acquisition/offline preparation passed. No compiler rebuild, infrastructure execution, raw-input artifact or cloud credential is involved. Action source is pinned to aa619a35a674a0be901650379db3b0551ee645ad; hosted evidence will be recorded before merge.

[github-actions]

Rootform

CLI 0.1.0-pr.117.1.

Architecture

Rootform architecture

76 instances, 18 Relations, 68 Contexts, and 14 Contributions added.

Plan analyzed. Planned changes compare Refreshed with Planned.

Uncertainty

	Planned
Indeterminate closures	27
Unavailable	26
Unknown until apply	1

Category	Added	Removed
Instances	76	0
Relations	18	0
Contexts	68	0
Contributions	14	0

Indeterminate closures: 27 in Planned.

Reported drift

No drift reported in this plan. The export does not establish the refresh scope.

Net change

Same determined changes as Planned changes.

Planned changes

Instances: 76 added (10 of 76 shown)

• google_cloud_run_v2_job.legacy_warehouse_sync
• google_cloud_run_v2_service.enrichment
• google_cloud_run_v2_service.ingest_api
• google_cloud_run_v2_service.warehouse_loader
• google_compute_firewall.allow_health_checks
• google_compute_firewall.allow_internal
• google_compute_global_address.private_services
• google_compute_network.shared
• google_compute_router.shared
• google_compute_router_nat.shared

Relations: 18 added (10 of 18 shown)

• delivers-to from google_pubsub_subscription.events_enriched_warehouse to google_cloud_run_v2_service.warehouse_loader
• delivers-to from google_pubsub_subscription.events_raw_enrichment to google_cloud_run_v2_service.enrichment
• routes-to from google_cloud_run_v2_service.enrichment to google_vpc_access_connector.data
• routes-to from google_cloud_run_v2_service.ingest_api to google_vpc_access_connector.data
• routes-to from google_cloud_run_v2_service.warehouse_loader to google_vpc_access_connector.data
• runs-as from google_cloud_run_v2_service.enrichment to google_service_account.enrichment
• runs-as from google_cloud_run_v2_service.ingest_api to google_service_account.ingest_api
• runs-as from google_cloud_run_v2_service.warehouse_loader to google_service_account.warehouse_loader
• subscribes-to from google_pubsub_subscription.events_enriched_sessions to google_pubsub_topic.events_enriched
• subscribes-to from google_pubsub_subscription.events_enriched_warehouse to google_pubsub_topic.events_enriched

Contexts: 68 added (10 of 68 shown)

• ownership: google_cloud_run_v2_job.legacy_warehouse_sync within google_project.data
• ownership: google_cloud_run_v2_service.enrichment within google_project.data
• ownership: google_cloud_run_v2_service.ingest_api within google_project.data
• ownership: google_cloud_run_v2_service.warehouse_loader within google_project.data
• ownership: google_compute_firewall.allow_health_checks within google_project.network
• ownership: google_compute_firewall.allow_internal within google_project.network
• ownership: google_compute_network.shared within google_project.network
• ownership: google_compute_router.shared within google_project.network
• ownership: google_compute_router_nat.shared within google_compute_router.shared
• ownership: google_compute_subnetwork.data within google_project.network

Contributions: 14 added (10 of 14 shown)

• google_compute_global_address.private_services contributes to google_compute_network.shared
• google_container_node_pool.workloads contributes to google_container_cluster.data
• google_monitoring_slo.ingest_api_availability contributes to google_monitoring_service.ingest_api
• google_project_iam_member.enrichment_publisher contributes to google_service_account.enrichment
• google_project_iam_member.gke_nodes_log_writer contributes to google_service_account.gke_nodes
• google_project_iam_member.gke_nodes_metric_writer contributes to google_service_account.gke_nodes
• google_project_iam_member.ingest_api_publisher contributes to google_service_account.ingest_api
• google_project_iam_member.pubsub_push_invoker contributes to google_service_account.pubsub_push
• google_project_iam_member.streaming_subscriber contributes to google_service_account.streaming
• google_project_iam_member.warehouse_loader_sql_client contributes to google_service_account.warehouse_loader

Planned architecture

• Instances: 76
• Interpreted: 76
• Relations: 18
• Contexts: 68
• Contributions: 14

Provenance

• Input: fixtures/rootform/examples/playground/shared-data-platform/base/plan.json
• Producer: Terraform or OpenTofu 1.16.4
• Plan completeness: Complete, as reported in the plan
• Enrichment: Saved plan paired with this plan JSON (1 module)
• Stage: Planned
• Stages: Recorded (reconstructed), Refreshed, Planned

Each list above shows at most 10 entries. A report written with --details lists every entry.

Policies

Rootform Policies

VIOLATED: Planned architecture

1 Policy selected. 1 evaluation violated.

qualification.policy.deny-database

Requirement: Synthetic negative qualification policy.

Violated: 1 evaluation

• google_sql_database_instance.data: The assertion's queries found no fact or closure.

Provenance

• Input: form.json
• Origin: Plan (saved Form)

Workflow run | Download evidence