Ports orca-cloud f24f3b4 (#464). The Terraform root is byte-identical to that
commit, including the new github_accepted_repositories variable and
relay-github-workflow-trust.tf, so every relay provider now admits
stablyai/orca alongside stablyai/orca-cloud. The tfvars already name this
repository's cloud- prefixed workflow paths on the stablyai/orca arm.
Ten scripts were three-way merged so the public-repo adaptations survive: the
relayWorkflowFile/relayWorkflowPath/readRelayWorkflow indirection, the census
keys, and the workflow directory depth. The condition renderer keeps the apps
root declared and skips it when the directory is absent, so its expectations
stay a straight copy of the private original. The staging deploy identity's
rendered-length pin keeps the private repository's 797 and derives this copy's
difference from the filename prefix.
Drop the two runbooks that walk through the foundation/apps roots, trim the
Cloud SQL consumer contract's source notes to what the relay needs, scan the
lease action's history in Cloud Verify, and exclude that action from the
monorepo formatter so syncs from the private repo stay byte-identical.
defaults.run.working-directory: cloud does not exist before actions/checkout,
so the eight guard/gate steps that run first (and the two checkout-free jobs,
clock-skew and requeue) failed to start. Pin those steps to '.'. The pretest
lease-action paths are ../.github from cloud/, and the two bare pnpm setups
read cloud/package.json instead of the root's pnpm 12. Cloud Verify now also
triggers on the lease action.
Each workflow is copied under a cloud- prefix, runs from cloud/ through a
workflow-level defaults block, and resolves pnpm and the Node cache against
cloud/package.json and cloud/pnpm-lock.yaml. Display names are unchanged
because the recovery chain matches on them; every reusable call, gh dispatch,
and jq run-path check was repointed to the prefixed filenames.
Every job that can start on its own is gated on the repository variable
ORCA_CLOUD_OPERATIONS_ENABLED, so both scheduled triggers and every manual
dispatch skip without running a step until the owner enables them. Reusable
jobs inherit the caller's gate rather than restating it. A new contract test
pins the gate, the three chained display names, and the absence of any
repository secret other than the automatic token.
Copies the private repository's relay side: the IAM-only fence broker, the
operations console and incident monitor, the relay Terraform root with its
backend configuration and tfvars, and the deploy/capacity/admission/rehome/
monitoring scripts the workflows call, with their contract tests, contracts,
and fixtures.
The foundation and apps Terraform roots and the API and auth services stay
private. Four surfaces that spanned both trees are narrowed to the relay side
rather than left with a dangling read: the infra runner and the root-partition
and workload-identity-condition renderers now declare only the relay root, and
the Cloud SQL rollout census drops the six app workflows that are not here.
Import the relay server and its wire contract under cloud/ as an independent
pnpm workspace, with a Cloud Verify workflow that builds, tests, and
secret-scans it.
Jinwoo-H
Jinwoo-H