Skip to content

test: qualify the published 0.2.0 release through the v1 action - #5

Closed
soulbah wants to merge 2 commits into
qualification/published-releasefrom
test/published-0.2.0
Closed

soulbah wants to merge 2 commits into
qualification/published-releasefrom
test/published-0.2.0

Conversation

@soulbah

@soulbah soulbah commented Oct 9, 2026 •

Copy link
Copy Markdown
Contributor

Change

Qualifies the published release path as a consumer uses it: rootform-dev/action@v1 (v1.0.0, 86eb7a7ca072d3564c4ca66f074cdc2e2763bf04) installs the published Rootform 0.2.0, analyzes the public shared-data-platform plan from tag v0.2.0, evaluates the synthetic negative Policy Pack and updates one PR comment. The job is expected to fail on the Policy violation; a final step checks that the failure is exactly qualification.policy.deny-database on google_sql_database_instance.data and that one report comment carries it.

Validation

  • actionlint on the workflow.
  • The negative pack yields VIOLATED with exit code 1 under the 0.2.0 CLI.
  • Hosted run 37883709651: rootform-dev/action@v1 resolved to 86eb7a7ca072d3564c4ca66f074cdc2e2763bf04; the review step failed on the Policy gate as expected, and the confirmation step passed (CLI 0.2.0, exit code 1, one violated evaluation qualification.policy.deny-database on google_sql_database_instance.data, planned stage).
  • Report comment 6074228686 by github-actions[bot], the only report comment on this PR.
  • Artifact 11595109837 holds the Form and derived reports.

This PR is evidence only and closes without merging.

@github-actions

github-actions Bot commented Oct 9, 2026

Copy link
Copy Markdown

Rootform

CLI 0.2.0.

Architecture

76 instances, 18 Relations, 68 Contexts, and 14 Contributions added.

Plan analyzed. Planned changes compare Refreshed with Planned.

? Uncertainty

Stage Indeterminate closures Unavailable Unknown until apply
Planned 27 26 1

± Planned changes

Change Instances Relations Contexts Contributions
+ Added 76 18 68 14
− Removed 0 0 0 0
Instances: 76 added
  • google_cloud_run_v2_job.legacy_warehouse_sync
  • google_cloud_run_v2_service.enrichment
  • google_cloud_run_v2_service.ingest_api
  • google_cloud_run_v2_service.warehouse_loader
  • google_compute_firewall.allow_health_checks
  • google_compute_firewall.allow_internal
  • google_compute_global_address.private_services
  • google_compute_network.shared
  • google_compute_router.shared
  • google_compute_router_nat.shared
  • google_compute_subnetwork.data
  • google_compute_subnetwork.gke
  • google_compute_subnetwork.serverless
  • google_container_cluster.data
  • google_container_node_pool.workloads
  • google_monitoring_alert_policy.subscription_backlog
  • google_monitoring_service.ingest_api
  • google_monitoring_slo.ingest_api_availability
  • google_project.data
  • google_project.network
  • google_project_iam_member.enrichment_publisher
  • google_project_iam_member.gke_nodes_log_writer
  • google_project_iam_member.gke_nodes_metric_writer
  • google_project_iam_member.ingest_api_publisher
  • google_project_iam_member.pubsub_push_invoker
  • google_project_iam_member.streaming_subscriber
  • google_project_iam_member.warehouse_loader_sql_client
  • google_pubsub_subscription.events_enriched_sessions
  • google_pubsub_subscription.events_enriched_warehouse
  • google_pubsub_subscription.events_raw_enrichment
  • google_pubsub_subscription.events_raw_stream_consumer
  • google_pubsub_topic.events_enriched
  • google_pubsub_topic.events_raw
  • google_redis_instance.data
  • google_secret_manager_secret.ingest_hmac
  • google_secret_manager_secret.legacy_warehouse
  • google_secret_manager_secret.warehouse_db_password
  • google_secret_manager_secret_version.ingest_hmac
  • google_secret_manager_secret_version.legacy_warehouse
  • google_secret_manager_secret_version.warehouse_db_password
  • google_service_account.enrichment
  • google_service_account.gke_nodes
  • google_service_account.ingest_api
  • google_service_account.pubsub_push
  • google_service_account.streaming
  • google_service_account.warehouse_loader
  • google_service_networking_connection.private_services
  • google_sql_database_instance.data
  • google_vpc_access_connector.data
  • kubernetes_daemon_set_v1.otel_collector
  • kubernetes_deployment_v1.analytics_api
  • kubernetes_deployment_v1.feature_builder
  • kubernetes_deployment_v1.session_windower
  • kubernetes_deployment_v1.stream_consumer
  • kubernetes_horizontal_pod_autoscaler_v1.analytics_api
  • kubernetes_ingress_v1.analytics
  • kubernetes_namespace_v1.analytics
  • kubernetes_namespace_v1.batch
  • kubernetes_namespace_v1.observability
  • kubernetes_namespace_v1.streaming
  • kubernetes_network_policy_v1.analytics
  • kubernetes_network_policy_v1.batch
  • kubernetes_network_policy_v1.observability
  • kubernetes_network_policy_v1.streaming
  • kubernetes_service_account_v1.analytics_api
  • kubernetes_service_account_v1.feature_builder
  • kubernetes_service_account_v1.feature_store
  • kubernetes_service_account_v1.otel_collector
  • kubernetes_service_account_v1.prometheus
  • kubernetes_service_account_v1.session_windower
  • kubernetes_service_account_v1.stream_consumer
  • kubernetes_service_v1.analytics_api
  • kubernetes_service_v1.feature_store
  • kubernetes_service_v1.prometheus
  • kubernetes_stateful_set_v1.feature_store
  • kubernetes_stateful_set_v1.prometheus
Relations: 18 added
  • delivers-to from google_pubsub_subscription.events_enriched_warehouse to google_cloud_run_v2_service.warehouse_loader
  • delivers-to from google_pubsub_subscription.events_raw_enrichment to google_cloud_run_v2_service.enrichment
  • routes-to from google_cloud_run_v2_service.enrichment to google_vpc_access_connector.data
  • routes-to from google_cloud_run_v2_service.ingest_api to google_vpc_access_connector.data
  • routes-to from google_cloud_run_v2_service.warehouse_loader to google_vpc_access_connector.data
  • runs-as from google_cloud_run_v2_service.enrichment to google_service_account.enrichment
  • runs-as from google_cloud_run_v2_service.ingest_api to google_service_account.ingest_api
  • runs-as from google_cloud_run_v2_service.warehouse_loader to google_service_account.warehouse_loader
  • subscribes-to from google_pubsub_subscription.events_enriched_sessions to google_pubsub_topic.events_enriched
  • subscribes-to from google_pubsub_subscription.events_enriched_warehouse to google_pubsub_topic.events_enriched
  • subscribes-to from google_pubsub_subscription.events_raw_enrichment to google_pubsub_topic.events_raw
  • subscribes-to from google_pubsub_subscription.events_raw_stream_consumer to google_pubsub_topic.events_raw
  • runs-as from kubernetes_deployment_v1.analytics_api to kubernetes_service_account_v1.analytics_api
  • runs-as from kubernetes_deployment_v1.feature_builder to kubernetes_service_account_v1.feature_builder
  • runs-as from kubernetes_deployment_v1.session_windower to kubernetes_service_account_v1.session_windower
  • runs-as from kubernetes_deployment_v1.stream_consumer to kubernetes_service_account_v1.stream_consumer
  • runs-as from kubernetes_stateful_set_v1.feature_store to kubernetes_service_account_v1.feature_store
  • runs-as from kubernetes_stateful_set_v1.prometheus to kubernetes_service_account_v1.prometheus
Contexts: 68 added
  • ownership: google_cloud_run_v2_job.legacy_warehouse_sync within google_project.data
  • ownership: google_cloud_run_v2_service.enrichment within google_project.data
  • ownership: google_cloud_run_v2_service.ingest_api within google_project.data
  • ownership: google_cloud_run_v2_service.warehouse_loader within google_project.data
  • ownership: google_compute_firewall.allow_health_checks within google_project.network
  • ownership: google_compute_firewall.allow_internal within google_project.network
  • ownership: google_compute_network.shared within google_project.network
  • ownership: google_compute_router.shared within google_project.network
  • ownership: google_compute_router_nat.shared within google_compute_router.shared
  • ownership: google_compute_subnetwork.data within google_project.network
  • ownership: google_compute_subnetwork.gke within google_project.network
  • ownership: google_compute_subnetwork.serverless within google_project.network
  • ownership: google_container_cluster.data within google_project.data
  • ownership: google_monitoring_alert_policy.subscription_backlog within google_project.data
  • ownership: google_monitoring_service.ingest_api within google_project.data
  • ownership: google_monitoring_slo.ingest_api_availability within google_project.data
  • ownership: google_pubsub_subscription.events_enriched_sessions within google_project.data
  • ownership: google_pubsub_subscription.events_enriched_warehouse within google_project.data
  • ownership: google_pubsub_subscription.events_raw_enrichment within google_project.data
  • ownership: google_pubsub_subscription.events_raw_stream_consumer within google_project.data
  • ownership: google_pubsub_topic.events_enriched within google_project.data
  • ownership: google_pubsub_topic.events_raw within google_project.data
  • ownership: google_redis_instance.data within google_project.data
  • ownership: google_secret_manager_secret.ingest_hmac within google_project.data
  • ownership: google_secret_manager_secret.legacy_warehouse within google_project.data
  • ownership: google_secret_manager_secret.warehouse_db_password within google_project.data
  • ownership: google_service_account.enrichment within google_project.data
  • ownership: google_service_account.gke_nodes within google_project.data
  • ownership: google_service_account.ingest_api within google_project.data
  • ownership: google_service_account.pubsub_push within google_project.data
  • ownership: google_service_account.streaming within google_project.data
  • ownership: google_service_account.warehouse_loader within google_project.data
  • ownership: google_sql_database_instance.data within google_project.data
  • ownership: google_vpc_access_connector.data within google_project.data
  • ownership: kubernetes_daemon_set_v1.otel_collector within kubernetes_namespace_v1.observability
  • ownership: kubernetes_deployment_v1.analytics_api within kubernetes_namespace_v1.analytics
  • ownership: kubernetes_deployment_v1.feature_builder within kubernetes_namespace_v1.batch
  • ownership: kubernetes_deployment_v1.session_windower within kubernetes_namespace_v1.streaming
  • ownership: kubernetes_deployment_v1.stream_consumer within kubernetes_namespace_v1.streaming
  • ownership: kubernetes_horizontal_pod_autoscaler_v1.analytics_api within kubernetes_namespace_v1.analytics
  • ownership: kubernetes_ingress_v1.analytics within kubernetes_namespace_v1.analytics
  • ownership: kubernetes_network_policy_v1.analytics within kubernetes_namespace_v1.analytics
  • ownership: kubernetes_network_policy_v1.batch within kubernetes_namespace_v1.batch
  • ownership: kubernetes_network_policy_v1.observability within kubernetes_namespace_v1.observability
  • ownership: kubernetes_network_policy_v1.streaming within kubernetes_namespace_v1.streaming
  • ownership: kubernetes_service_account_v1.analytics_api within kubernetes_namespace_v1.analytics
  • ownership: kubernetes_service_account_v1.feature_builder within kubernetes_namespace_v1.batch
  • ownership: kubernetes_service_account_v1.feature_store within kubernetes_namespace_v1.batch
  • ownership: kubernetes_service_account_v1.otel_collector within kubernetes_namespace_v1.observability
  • ownership: kubernetes_service_account_v1.prometheus within kubernetes_namespace_v1.observability
  • ownership: kubernetes_service_account_v1.session_windower within kubernetes_namespace_v1.streaming
  • ownership: kubernetes_service_account_v1.stream_consumer within kubernetes_namespace_v1.streaming
  • ownership: kubernetes_service_v1.analytics_api within kubernetes_namespace_v1.analytics
  • ownership: kubernetes_service_v1.feature_store within kubernetes_namespace_v1.batch
  • ownership: kubernetes_service_v1.prometheus within kubernetes_namespace_v1.observability
  • ownership: kubernetes_stateful_set_v1.feature_store within kubernetes_namespace_v1.batch
  • ownership: kubernetes_stateful_set_v1.prometheus within kubernetes_namespace_v1.observability
  • network: google_compute_firewall.allow_health_checks within google_compute_network.shared
  • network: google_compute_firewall.allow_internal within google_compute_network.shared
  • network: google_compute_router.shared within google_compute_network.shared
  • network: google_compute_subnetwork.data within google_compute_network.shared
  • network: google_compute_subnetwork.gke within google_compute_network.shared
  • network: google_compute_subnetwork.serverless within google_compute_network.shared
  • network: google_container_cluster.data within google_compute_network.shared
  • network: google_container_cluster.data within google_compute_subnetwork.gke
  • network: google_redis_instance.data within google_compute_network.shared
  • network: google_sql_database_instance.data within google_compute_network.shared
  • network: google_vpc_access_connector.data within google_compute_subnetwork.serverless
Contributions: 14 added
  • google_compute_global_address.private_services contributes to google_compute_network.shared
  • google_container_node_pool.workloads contributes to google_container_cluster.data
  • google_monitoring_slo.ingest_api_availability contributes to google_monitoring_service.ingest_api
  • google_project_iam_member.enrichment_publisher contributes to google_service_account.enrichment
  • google_project_iam_member.gke_nodes_log_writer contributes to google_service_account.gke_nodes
  • google_project_iam_member.gke_nodes_metric_writer contributes to google_service_account.gke_nodes
  • google_project_iam_member.ingest_api_publisher contributes to google_service_account.ingest_api
  • google_project_iam_member.pubsub_push_invoker contributes to google_service_account.pubsub_push
  • google_project_iam_member.streaming_subscriber contributes to google_service_account.streaming
  • google_project_iam_member.warehouse_loader_sql_client contributes to google_service_account.warehouse_loader
  • google_secret_manager_secret_version.ingest_hmac contributes to google_secret_manager_secret.ingest_hmac
  • google_secret_manager_secret_version.legacy_warehouse contributes to google_secret_manager_secret.legacy_warehouse
  • google_secret_manager_secret_version.warehouse_db_password contributes to google_secret_manager_secret.warehouse_db_password
  • google_service_networking_connection.private_services contributes to google_compute_network.shared

↺ Reported drift

No drift reported in this plan. The export does not establish the refresh scope.

Terraform and OpenTofu omit drift records both when refresh finds no drift and when refresh does not run.

Plan JSON does not record whether refresh was limited (-refresh=false, -target); an unrefreshed object reports no drift; data sources and deposed objects are outside drift records.

Δ Net change

Same determined changes as Planned changes.

▦ Planned architecture

  • Instances: 76
  • Interpreted: 76
  • Relations: 18
  • Contexts: 68
  • Contributions: 14
  • Closures: 139 (100 resolved, 12 absent, 27 indeterminate)

Interpreted counts the instances a Rule matched; Relations, Contexts, and Contributions count determined facts; Uncertainty counts what the evidence could not settle.


Policies

Caution

Verdict: VIOLATED

▦ Planned architecture

1 Policy selected. 1 evaluation violated.

qualification.policy.deny-database

Requirement: Synthetic negative qualification policy.

Violated: 1 evaluation

  • google_sql_database_instance.data: The assertion's queries found no fact or closure.

Details

Provenance
  • Input: fixtures/rootform/examples/playground/shared-data-platform/base/plan.json

  • Plan completeness: Complete, as reported in the plan

  • Enrichment: Saved plan paired with this plan JSON (1 module)

  • Stage: Planned

  • Stages: Recorded (reconstructed from Refreshed; no drift entry to reverse), Refreshed, Planned

  • Semantics: 18 Dialects, 1 RF Vocabulary

  • Input: form.json

  • Origin: Plan (saved Form)

  • Policy Packs: qualification 0.1.0

Workflow run | Download evidence

@soulbah soulbah closed this Oct 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant