[yomgui]

Summary

The managed Google Cloud installer (Den's "Deploy to Google Cloud") had its own copy of every resource: Cloud SQL, secrets, Cloud Run services, load balancer. It now uses the shared module, infra/terraform/modules/openwork-gcp-cloud-run, like the AWS installer did in #6188. The main change for managed installs: database migrations run once, in a dedicated step, before the new API and web start, behind a maintenance fence that stops every old revision first.

Existing installs keep everything: the same Cloud SQL instance and database (MySQL stays 8.0), users, secret values, service names and endpoints. 31 Terraform moved addresses carry the existing resources over without recreating them.

This PR doesn't publish an installer or change a deployment by itself. It doesn't move managed installs to MySQL 8.4 or to write-only secrets; both stay separate, owner-approved changes.

What managed customers will see on their next update

1. Den asks them to approve an updated setup in Cloud Shell. The runner gets one extra permission, monitoring.timeSeries.list, to check that old revisions are really idle. The person approving needs to be able to create custom roles and change IAM on the deployment's service accounts (documented).

2. A short downtime on update:

   1. the installer stops the OpenWork services and their revision tags, and waits until every old revision shows zero activity;
   2. it runs the migration once, then prepares the new API revision while still stopped;
   3. it restores traffic and checks health.

   If the migration or revision preparation fails, maintenance stays in place.

3. Cloud Run revision tags on the OpenWork services are removed on each update; recreate the ones you need afterwards.

4. Nothing else changes: same URLs, data, users and sessions.

Bugs found and fixed while testing this live

What failed live	Fix
Den's launcher rejected the new installer archive (shared module paths)	Den accepts exactly the shared module's root .tf files
Image check rejected Docker Hub's short name (python@sha256:…)	Docker Hub aliases normalized; digest and platform still checked exactly
Terraform needed the Resource Manager API	Added to the APIs the bootstrap enables
Revision check relied on a field Cloud Run omits	Checks the actual revision (parent, UID, image, command, traffic)
Health check rejected a tagged revision at 0% (field omitted)	Missing percent read as 0; other checks unchanged
Upgrade plan would have recreated the database user (host mismatch)	Existing empty host preserved for managed installs
Concurrent health reports got HTTP 409	One fresh retry for that exact error; the installer waits only for its own health run; server anti-replay unchanged

Docs also list the operator prerequisites and the pki.goog CAA requirement for the managed HTTPS certificate.

How this was checked

Live, in a test project through an isolated Den (this exact head, 26fdbbf2b):

• a fresh install from current dev;
• then a real Den Update to this branch:
  • the plan was accepted: no deletion, database user unchanged;
  • every old revision, including a tagged one, was stopped before exactly one migration;
  • all 31 moves were applied;
  • the new revision became ready, then traffic resumed;
  • the installer's own health run succeeded;
• after the update: original session still valid, fresh sign-in OK, same Cloud SQL 8.0 database and users, the 4 secrets unchanged;
• everything was destroyed and verified afterwards.

A fresh install of this branch also passed live (Oct 20).

Offline:

Check	Result
Installer Python tests	150 passed
Den GCP tests	13 passed
Managed installer Terraform	passed
Shared module, Terraform and OpenTofu	36 each
CI	all green, Warden approved

Managed provider lock: Google 6.49 → 8.7, random 3.7 → 3.9.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

4 Skipped Deployments

Project	Deployment	Actions	Updated
openwork-app	Ignored	Preview	Oct 22, 2026 2:14am UTC
openwork-den	Ignored	Preview	Oct 22, 2026 2:14am UTC
openwork-diagnostics	Ignored	Preview	Oct 22, 2026 2:14am UTC
openwork-landing	Ignored	Preview	Oct 22, 2026 2:14am UTC

[github-actions]

OpenWork evidence

Status	Commit	Preview	Updated
🟢 Ready · evidence passed	26fdbbf	Open preview	2026-10-22 02:23:57 UTC

Run details · Open the preview to inspect evidence and sandbox options.

[diff-warden]

Warden clearance. Complete security and confidentiality review of 3d56d1caade171f5542cef9e82ad8e2c36bea216 found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run

[diff-warden]

Warden: approved

No high or medium security findings and no confidentiality findings.

_{Reviewed 26fdbbf2bfa8 · Warden run · Updates after every Warden run.}

[diff-warden]

Warden clearance. Complete security and confidentiality review of f0cc7951e668c057c3ccac11a3094cd4a3c2d4e1 found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run

[diff-warden]

Warden clearance. Complete security and confidentiality review of 52665f073f95d89f3d7a253b8991fca263afb661 found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run

[diff-warden]

Warden clearance. Complete security and confidentiality review of 39c019eed020cbf43a825b8bf95b9bce5fda6832 found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run

[diff-warden]

Warden clearance. Complete security and confidentiality review of 18d02db18c22d834001f6cfd37c154b7795d7c6c found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run

[diff-warden]

Warden clearance. Complete security and confidentiality review of 92d52bfc15cc4d3bc1e19fd11b6b86aadeb4326e found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run

[diff-warden]

Warden clearance. Complete security and confidentiality review of 1dace39c9c09abad1936fc891c6f601cb44386ed found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run

[diff-warden]

Warden clearance. Complete security and confidentiality review of 26fdbbf2bfa81264c120af7d6e62a705b6c1ddc8 found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run