feat(ge-demo-generator): Cloud Run org-policy diagnosis, IAM 2-tier fallback, Layer 9, and setup docs alignment (v12.23-public) - #3105
Merged
holtskinner merged 3 commits intoSep 11, 2026
Conversation
…n unset VPC egress (v12.21-public)
Hardened Google Cloud projects reject `gcloud run deploy` before anything is
built:
constraints/run.allowedVPCEgress violated ... annotation
"run.googleapis.com/vpc-access-egress" set to null
constraints/run.allowedBinaryAuthorizationPolicies violated ... annotation
"run.googleapis.com/binary-authorization" set to null
Both are list policies, and `CreateService` with the matching annotation unset
counts as a violation of a non-empty `allowedValues`, so such a project refuses
a service for an annotation it never mentioned. There is no value meaning
"leave it unset" - `--vpc-egress` accepts only `private-ranges-only` and
`all-traffic`, and gcloud rejects the flag unless a network or connector comes
with it - so the deploy cannot be made to comply by dropping something.
Until now the run ended with a raw gcloud stack trace, which names a policy and
explains nothing; the operator concludes the generator is broken. Worse, the
account running the demo usually cannot read the policy at all, because it is
inherited from a folder it has no access to.
Both deploy surfaces now explain the refusal, name the flag that satisfies each
constraint, print the command that reads the project's allowed values, and say
where to put them:
GE_RUN_NETWORK=... GE_RUN_SUBNET=... GE_RUN_VPC_EGRESS=... GE_RUN_BINAUTHZ=...
Set in `.env`, those four are picked up automatically on the next run. They are
empty on every unconstrained project, so the deploy command is byte-for-byte
what it always was.
The Data Viewer stays fail-soft and now says why it was skipped, rather than
reporting "skipped (optional)" for what is actually a policy refusal.
…allback, Layer 9, and setup docs alignment (v12.23-public) - Update Data Viewer deployment error diagnostics in Code.gs to detect generic Cloud Functions / Cloud Run org policy refusals and explain all applicable constraints. - Implement 2-tier fallback for IAM signBlob and actAs bindings (resource-level self-binding first, falling back to project-level when resource policy manipulation is restricted). - Add Layer 9 (AI Governance & Telemetry IAM verification & self-healing) to verify_and_heal.py. - Align README and package.json with Clasp v3 commands (clasp open-script) and fix setup docs to clarify root directory execution and prevent misplaced cd app runs. - Correct manual spreadsheet authorization function name to forceAuthorize. - Bump APP_VERSION to v12.23-public and update SKILL.md to v2.25.0. - Update spelling allow-list for newly introduced tokens.
ryotat7
changed the title
holtskinner
approved these changes
Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR updates the GE Demo Generator to v12.23-public (skill v2.25.0), bringing four essential reliability improvements, architectural enhancements, and documentation alignments:
Cloud Run Organization Policy Diagnostics:
app/Code.gsandsetup_and_deploy.sh) detectconstraints/run.allowedVPCEgressandconstraints/run.allowedBinaryAuthorizationPoliciesrefusals.Org Policiesrefusals where constraint names are omitted bygcloud functions deploy, ensuring clear guidance is shown instead of an unexplained 400 error.IAM 2-Tier Fallback for
signBlobandactAs:roles/iam.serviceAccountTokenCreator(minting signed URLs viasignBlob) androles/iam.serviceAccountUser(Cloud Tasks worker dispatch) to the runtime compute service account, attempts resource-level self-binding first (gcloud iam service-accounts add-iam-policy-binding).gcloud projects add-iam-policy-binding).Autonomous Post-Deployment Verification & Self-Healing (Layer 9):
verify_and_heal.pyfrom 8 to 9 infrastructure layers, adding automated verification and self-healing for AI Governance & Telemetry (roles/cloudtrace.agentandroles/modelarmor.userwhen opted in).Web UI Setup Docs & Clasp v3 Alignment:
README.mdandapp/package.jsonto replace deprecatedclasp openwithclasp open-script.npm install, clarifies that.clasp.jsonbelongs in the project root pointing to{"rootDir": "app"}, and warns against running clasp from insideapp/(which caused empty deployments).forceAuthorizeSpreadsheettoforceAuthorize.Architectural Decision Records (ADRs)
Org-policy rejections are refused by the Cloud Run control plane in ~11 seconds before Cloud Build starts. Rather than burdening every user with speculative upfront API calls that require elevated permissions (
orgpolicy.policies.list), diagnostics trigger only on failure and inspect real error logs.Least-privilege principles favor resource-level self-binding for
signBlobandactAs. However, some enterprise environments restrict service account resource policy modification (setIamPolicyon service accounts). Falling back to project-level role grants ensures deployment resilience without sacrificing security.Clasp v3 configuration (
.clasp.json) operates from the project root with"rootDir": "app". Runningclaspfrom withinapp/causedTracked files: 0empty deployments. The documentation strictly establishes the project root as the execution directory.Internal automatic VPC/subnet provisioning repair scripts (
scripts/internal/orgpolicy_heal.sh) are intentionally excluded from public distributions to respect reader enterprise network governance. Only diagnostic explanations and remediation guidance are shipped publicly.Verification
tools/public_gates.shoffline rehearsal:v12.23-publicmatches internalv12.23-internal)node --check app/Code.gs: PASSpython3 -m py_compileon all Python scripts: PASS