Execution: wire prod auto-rebuild (gated-off) + verify prod bucket versioning + go-live checklist #29

Activity

1. Kenny-Heitritter

   added

   ready-for-agentTicket is scoped and ready for an agent to grab and implementTicket is scoped and ready for an agent to grab and implement

   on Jul 24, 2026
2. Kenny-Heitritter commented on Jul 24, 2026

   

   Kenny-Heitritter

   on Jul 24, 2026

   MemberAuthor

   More actions

   Implemented across two PRs — open for review (not merged).

   • Infra: qBraid/qbraid-infrastructure#620 (commits bacf662, cdb6d9f) — prod opencode-prod-main auto-rebuild wired but provably inert: commented step and withheld IAM (fails closed even if uncommented, since the executor SA holds no cloudbuild.builds.create). Same anti-cascade guardrails as staging.
   • Doc: docs(codeq): execution-era CODEQ_DEPLOYMENT.md sections (#25–#29) #42 — prod go-live checklist.

   Caveats (cannot be closed from source — no live GCP here):

   • Prod qbraid-codeq bucket object versioning must be confirmed live (gcloud storage buckets describe gs://qbraid-codeq --format='value(versioning.enabled)') — documented as a manual go-live gate rather than TF-declared (the bucket is out-of-band; importing it without creds risks a create/hijack).
   • Go-live gate Added a compass.yml file to manage this repository as a Compass component #1 (lab-base Trivy restored to --exit-code=1) is cross-repo (infra#331 / Dstacks#34/Wire Azure terraform into CI/CD (IaC runner: staging auto-apply, prod gated) #35/Add billing pricing + quota for the 3 models (qbraid-api) #38) and intentionally not flipped here.

   terraform validate passes; prod behavior unchanged.
3. Kenny-Heitritter

   added a commit that references this issue on Jul 24, 2026

   Merge pull request #42 from qBraid/codeq/deployment-doc-sections

   ...

   002f0f1
4. Kenny-Heitritter commented on Aug 1, 2026

   

   Kenny-Heitritter

   on Aug 1, 2026

   MemberAuthor

   More actions

   Prod go-live checklist — add an IAM item.

   Staging hit three separate IAM gaps getting the layer-1 auto-rebuild working, and the checklist as written only anticipates the first:

   1. Custom-role creation 403 — CI SA lacks iam.roles.create (holds roles/iam.securityAdmin, which is get/list only). Fixed in qbraid-infrastructure#699 by dropping the custom role for roles/cloudbuild.builds.editor. qbraid-prod's CI SA (github-actions-v2-terraform@) has the identical role set, so a prod custom role would 403 the same way.
   2. cloudbuild.builds.create on the trigger-runner SA — granted by the same PR.
   3. iam.serviceAccounts.actAs on the trigger's executor SA — gcloud builds triggers run submits a build that runs as the trigger's configured service account (build-lab-base-prod → cloud-build-prod@), so the trigger-runner needs roles/iam.serviceAccountUser on it. This is the reverse direction from the existing token-creator binding and is easy to miss. Fixed for staging in qbraid-infrastructure#700.

   anomalyco#698 ships prod IAM deliberately withheld, so none of these bite today — but all three are prerequisites for flipping the prod gate, in addition to the already-tracked lab-base Trivy --exit-code=1 restoration.

   Suggest adding to the go-live checklist in CODEQ_DEPLOYMENT.md:

   • prod trigger-runner SA exists with roles/cloudbuild.builds.editor (not a custom role)
   • prod trigger-runner SA holds roles/iam.serviceAccountUser on cloud-build-prod@
   • executor SA holds roles/iam.serviceAccountTokenCreator on the trigger-runner SA