From d59ac06cc0928c7b2369752c75cfad75afa1b4f4 Mon Sep 17 00:00:00 2001 From: Yvonne Yao Date: Sun, 30 Aug 2026 20:41:13 +1000 Subject: [PATCH] fix(ST-28): read deployed images for lockdown --- .github/workflows/public-domain-control.yml | 7 +++++-- .../config-validator/test/public-edge-assets.test.mjs | 10 ++++++++++ 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/public-domain-control.yml b/.github/workflows/public-domain-control.yml index eea2893..359afe8 100644 --- a/.github/workflows/public-domain-control.yml +++ b/.github/workflows/public-domain-control.yml @@ -130,9 +130,12 @@ jobs: set -euo pipefail api_prefix="memory-director/sandbox/app-api" web_prefix="memory-director/sandbox/app-web" - api_image="$(terraform -chdir=infra/terraform/components/app init -reconfigure -backend-config="bucket=${{ steps.config.outputs.state_bucket }}" -backend-config="prefix=$api_prefix" >/dev/null && terraform -chdir=infra/terraform/components/app output -raw api_image)" - web_image="$(terraform -chdir=infra/terraform/components/app init -reconfigure -backend-config="bucket=${{ steps.config.outputs.state_bucket }}" -backend-config="prefix=$web_prefix" >/dev/null && terraform -chdir=infra/terraform/components/app output -raw web_image)" + api_image="$(gcloud run services describe "${{ steps.config.outputs.resource_name }}-api" --project "${{ steps.config.outputs.project_id }}" --region "${{ steps.config.outputs.region }}" --format='value(spec.template.spec.containers[0].image)')" + web_image="$(gcloud run services describe "${{ steps.config.outputs.resource_name }}-web" --project "${{ steps.config.outputs.project_id }}" --region "${{ steps.config.outputs.region }}" --format='value(spec.template.spec.containers[0].image)')" mcp_endpoint="$(gcloud run services describe "${{ steps.config.outputs.resource_name }}-mcp" --project "${{ steps.config.outputs.project_id }}" --region "${{ steps.config.outputs.region }}" --format='value(status.url)')" + test -n "$api_image" + test -n "$web_image" + test -n "$mcp_endpoint" terraform -chdir=infra/terraform/components/app init -reconfigure -backend-config="bucket=${{ steps.config.outputs.state_bucket }}" -backend-config="prefix=$api_prefix" terraform -chdir=infra/terraform/components/app apply -auto-approve \ -var="project_config=${{ steps.config.outputs.project_config_file }}" \ diff --git a/infra/terraform/tools/config-validator/test/public-edge-assets.test.mjs b/infra/terraform/tools/config-validator/test/public-edge-assets.test.mjs index f3e399d..f44ecfc 100644 --- a/infra/terraform/tools/config-validator/test/public-edge-assets.test.mjs +++ b/infra/terraform/tools/config-validator/test/public-edge-assets.test.mjs @@ -25,3 +25,13 @@ test("serverless NEG backends do not set unsupported backend timeouts", () => { const module = readFileSync(new URL("infra/terraform/modules/foundations/public_edge/main.tf", repositoryRoot), "utf8"); assert.doesNotMatch(module, /resource "google_compute_backend_service" "(?:api|web)" \{[\s\S]*?timeout_sec/); }); + +test("lockdown reads the deployed Cloud Run images instead of absent Terraform state outputs", () => { + const workflow = readFileSync(new URL(".github/workflows/public-domain-control.yml", repositoryRoot), "utf8"); + assert.match(workflow, /gcloud run services describe "\$\{\{ steps\.config\.outputs\.resource_name \}\}-api".*--format='value\(spec\.template\.spec\.containers\[0\]\.image\)'/s); + assert.match(workflow, /gcloud run services describe "\$\{\{ steps\.config\.outputs\.resource_name \}\}-web".*--format='value\(spec\.template\.spec\.containers\[0\]\.image\)'/s); + assert.match(workflow, /test -n "\$api_image"/); + assert.match(workflow, /test -n "\$web_image"/); + assert.match(workflow, /test -n "\$mcp_endpoint"/); + assert.doesNotMatch(workflow, /terraform -chdir=infra\/terraform\/components\/app output -raw (?:api_image|web_image)/); +});