@caelo-cms/provisioning 0.10.53 → 0.10.55

package/src/upgrader-setup.ts

@@ -21,8 +21,9 @@
  *     move traffic, recreate the migration job, update its own job image.
  *     It includes no `*.setIamPolicy`.
  *   - `roles/iam.serviceAccountUser` on exactly the admin's and the
- *     gateway's runtime service accounts (a revision runs as them) and on
- *     itself (its own job) — not on the project.
+ *     gateway's runtime service accounts (a revision runs as them), on
+ *     itself (its own job) and on the quality-audit job's account (the
+ *     app-roll moves that job's image, #875) — not on the project.
  *   - the custom role `caeloUpgraderSqlBackup`: create/read Cloud SQL
  *     backups and read the instance — no restore, no instance changes.
  *   - `roles/cloudsql.instanceUser` + a Cloud SQL IAM database user that
@@ -51,6 +52,7 @@ import { ensureCloudSqlIamUser } from "./cloudsql-iam-user.js";
 import { gcloud as defaultGcloud, type GcloudResult } from "./gcloud.js";
 import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
 import {
+  auditServiceAccountEmail,
   gatewayServiceAccountEmail,
   mcpIapServiceAccountEmail,
   runServiceAccountEmail,
@@ -256,6 +258,11 @@ export async function ensureUpgraderJob(
       why: "gateway revisions run as it",
     },
     { account: sa, role: "roles/iam.serviceAccountUser", why: "the job updates its own image" },
+    {
+      account: auditServiceAccountEmail(projectId, env),
+      role: "roles/iam.serviceAccountUser",
+      why: "the app-roll moves the quality-audit job, which runs as it, onto the new image",
+    },
     {
       account: mcpIapServiceAccountEmail(projectId),
       role: "roles/iam.serviceAccountTokenCreator",

package/src/wizards/gcp-cost.ts

@@ -101,10 +101,10 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
           : `${inputs.adminMinInstances} min-instance${inputs.adminMinInstances > 1 ? "s" : ""} (no cold start)`,
     },
     {
-      name: "Quality checks (Lighthouse on the admin)",
-      monthlyUsd: 1,
+      name: "Quality checks (Cloud Run audit job)",
+      monthlyUsd: 2,
       notes:
-        "~2-4 min of admin CPU per audited Stage (up to 5 pages x 5 runs); ~$1/mo at a few Stages a day",
+        "one container per Lighthouse run, all in parallel (up to 5 pages x 3 runs, ~90 s at 2 vCPU each): ~$0.05 per audited Stage, partly in the free tier; results bucket ~$0",
     },
     {
       name: "Cloud Run gateway",

package/src/wizards/gcp-pulumi.ts

@@ -13,6 +13,7 @@
 
 import { resolve as resolvePath } from "node:path";
 import * as pulumi from "@pulumi/pulumi/automation";
+import { AUDIT_PARALLELISM_DEFAULT } from "../audit-job-setup.js";
 import { checkpointableOutputs } from "../checkpoint-secrets.js";
 import { GCP_STACK_ENV } from "../gcp-names.js";
 import type { ImageDigests } from "../install-state.js";
@@ -36,6 +37,12 @@ export const GCP_STACK_KNOB_DEFAULTS = {
   adminMemory: ADMIN_MEMORY_DEFAULT,
   gatewayMinInstances: 0,
   wafAdaptiveProtection: false,
+  /**
+   * #875 — audit tasks at once. Not stack config: the audit job is
+   * CLI-owned (audit-job-setup.ts), so the wizard passes it to the job and
+   * `upgrade` keeps whatever the job has.
+   */
+  auditParallelism: AUDIT_PARALLELISM_DEFAULT,
 } as const;
 
 export interface PulumiUpInputs {

package/src/wizards/gcp.ts

@@ -33,6 +33,7 @@ import { join } from "node:path";
 import { cancel, confirm, isCancel, log, note, select, spinner } from "@clack/prompts";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 import { checkAdcImpersonation } from "../adc-impersonation.js";
+import { ensureAuditJob, resolveAdminImage } from "../audit-job-setup.js";
 import { CERT_WAIT_TIMEOUT_MS, lbCertProbe, waitForCert } from "../cert-wait.js";
 import { redactCredentials } from "../checkpoint-secrets.js";
 import { removeDefaultFirewallRules } from "../default-firewall.js";
@@ -454,6 +455,10 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
 
   phase("Finishing: operator access, welcome page");
 
+  // === 11.3. The quality-audit job: parallel Lighthouse runs (#875) ===
+  // Before the upgrader, which gets actAs on the job's service account.
+  await stepAuditJob(projectId, region, provider);
+
   // === 11.4. The upgrader job: Settings → Updates → Install update (#696) ===
   // Before operator access, which keeps the upgrader's caelo-mcp grant.
   const releaseVersion = await releaseVersionForDigest(gcloud, "admin", imageDigests.admin);
@@ -976,6 +981,38 @@ async function stepUpgraderJob(
   return true;
 }
 
+/**
+ * Set up the quality-audit job (audit-job-setup.ts) on the deployed admin's
+ * image. A failure stops the wizard: without the job every Stage audit
+ * fails. Idempotent, so it runs on every wizard pass.
+ */
+async function stepAuditJob(
+  projectId: string,
+  region: string,
+  provider: "gcp" | "gcp-firebase",
+): Promise<void> {
+  const s = spinner();
+  s.start("Setting up the quality-audit job (parallel Lighthouse runs)...");
+  const image = await resolveAdminImage({ projectId, region, env: GCP_STACK_ENV });
+  const r = image.ok
+    ? await ensureAuditJob({
+        provider,
+        projectId,
+        region,
+        env: GCP_STACK_ENV,
+        adminImageRef: image.imageRef,
+        parallelism: GCP_STACK_KNOB_DEFAULTS.auditParallelism,
+      })
+    : { ok: false as const, done: [], error: image.error };
+  if (!r.ok) {
+    s.stop(red(`Failed: ${r.error}`));
+    log.error("Re-run the wizard once the cause is fixed (this step is idempotent).");
+    cancel("Aborted.");
+    process.exit(1);
+  }
+  s.stop(green(`Quality-audit job ready (${r.done.length} steps)`));
+}
+
 /**
  * Whether an upgrader set up by an earlier run exists, so a failed setup
  * this time still keeps its caelo-mcp signing grant (the operator-access

package/stacks/aws/index.ts

@@ -349,6 +349,14 @@ new aws.cloudwatch.LogDelivery(
 //
 // Each Caelo service runs as its own Fargate service; sharing a cluster
 // keeps the per-month Fargate-cluster fee at zero (clusters are free).
+//
+// FIXME(issue #749): no quality-audit task definition yet. On GCP every
+// Lighthouse run of a Stage audit runs in its own container (#875,
+// src/audit-job-setup.ts); the AWS equivalent is a Fargate task per run
+// (admin-core quality/parallel-runner.ts `AuditTaskLauncher`). Until it
+// exists the admin records every Lighthouse audit as failed with that gap
+// (quality/lighthouse-runner-select.ts) instead of measuring on its own
+// shared CPU. Nothing is staged on AWS before #749 either.
 const cluster = new aws.ecs.Cluster(`${namePrefix}-ecs`, {
   settings: [{ name: "containerInsights", value: "enabled" }],
 });

package/stacks/azure/index.ts

@@ -330,6 +330,15 @@ const logWorkspace = new azure.operationalinsights.Workspace(`${namePrefix}-logs
 });
 
 // === 6. Container Apps environment + apps ===
+//
+// FIXME(issue #750): no quality-audit Container Apps job yet. On GCP every
+// Lighthouse run of a Stage audit runs in its own container (#875,
+// src/audit-job-setup.ts); the Azure equivalent is a Container Apps job
+// with one replica per run (admin-core quality/parallel-runner.ts
+// `AuditTaskLauncher`). Until it exists the admin records every Lighthouse
+// audit as failed with that gap (quality/lighthouse-runner-select.ts)
+// instead of measuring on its own shared CPU. Nothing is staged on Azure
+// before #750 either.
 const cappEnv = new azure.app.ManagedEnvironment(`${namePrefix}-capp-env`, {
   resourceGroupName: rg.name,
   environmentName: `${namePrefix}-capp-env`,

package/stacks/gcp/index.ts

@@ -984,6 +984,19 @@ new gcp.iap.WebBackendServiceIamMember(
   opts,
 );
 
+// =========================================================================
+// Quality-audit job — deliberately NOT here
+// =========================================================================
+//
+// #875 — every Stage audit's Lighthouse runs execute in parallel in a Cloud
+// Run job, one task per run, under its own service account (results bucket
+// create-only, staged build read-only, no secrets, no VPC). The CLI owns the
+// job, its account, the results bucket and the grants
+// (packages/provisioning/src/audit-job-setup.ts, run by the wizard after
+// `pulumi up` and by `upgrade`), because `upgrade` never runs Pulumi: a
+// bucket or job both this program and `upgrade` created would collide on
+// the next wizard run. The app-roll moves the job's image with the admin's.
+
 // =========================================================================
 // Operator access — deliberately NOT here
 // =========================================================================

package/stacks/gcp-firebase/index.ts

@@ -900,6 +900,19 @@ new gcp.iap.WebCloudRunServiceIamMember(
   opts,
 );
 
+// =========================================================================
+// Quality-audit job — deliberately NOT here
+// =========================================================================
+//
+// #875 — every Stage audit's Lighthouse runs execute in parallel in a Cloud
+// Run job, one task per run, under its own service account (results bucket
+// create-only, staged build read-only, no secrets, no VPC). The CLI owns the
+// job, its account, the results bucket and the grants
+// (packages/provisioning/src/audit-job-setup.ts, run by the wizard after
+// `pulumi up` and by `upgrade`), because `upgrade` never runs Pulumi: a
+// bucket or job both this program and `upgrade` created would collide on
+// the next wizard run. The app-roll moves the job's image with the admin's.
+
 // =========================================================================
 // Operator access — deliberately NOT here
 // =========================================================================