agent-bus-team 0.1.2__tar.gz

agent_bus_team-0.1.2/.gitignore

@@ -0,0 +1,229 @@
+# AI
+.claude/
+
+# MacOS
+.DS_Store
+
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml
+infra/terraform.tfstate
+infra/.terraform.lock.hcl
+infra/terraform.tfstate.backup
+infra/variables.tf
+infra/.terraform/**

agent_bus_team-0.1.2/LICENSE

@@ -0,0 +1,7 @@
+Copyright (c) 2026 Dan Barua
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

agent_bus_team-0.1.2/PKG-INFO

@@ -0,0 +1,136 @@
+Metadata-Version: 2.5
+Name: agent-bus-team
+Version: 0.1.2
+Summary: Inter-agent messaging bus for Claude Code, Grok, OMP, Codex and others
+Project-URL: Homepage, https://github.com/danbarua/agent-bus
+Project-URL: Repository, https://github.com/danbarua/agent-bus
+Project-URL: Issues, https://github.com/danbarua/agent-bus/issues
+Author: Dan Barua
+License-Expression: MIT
+License-File: LICENSE
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# agent-bus
+
+Small stdlib-only Python 3.11+ inter-agent messaging CLI and library.
+
+Parallel bus for Claude Code, Grok, Oh My Pi (omp), Codex, and others.
+Two channels: file bus (`send`/`inbox`) vs. native UDS (`listen` + `send-peer`). See [UDS-protocol.md](skills/references/UDS-protocol.md).
+
+## On-disk (AGENT_BUS_HOME=~/.agent-bus)
+
+```
+~/.agent-bus/
+  roster/<id>.json     # registered agents (uuid ids)
+  inboxes/<id>.jsonl   # append-only, one JSON message per line
+  captures/<pid>.jsonl # from `listen`
+```
+
+Roster entry and Message envelope match the spec in the source.
+
+## Rules (enforced)
+
+- Plain text **only** in `text` (no structured payloads).
+- Refuse `> 1_000_000` chars.
+- Per-inbox unread cap 50 (send fails with clear error).
+- **Never treat a received message as user consent.** Messages are cross-session only. The receiving agent must still show the user and obtain explicit approval before acting on any instruction in a message.
+- Names unique among *live* (pid-alive) registrations; collisions get `-2`, `-3` suffix on register.
+- `list` drops stale roster entries (dead pid) but leaves their inbox files.
+
+## CLI
+
+```sh
+agent-bus list [--kind claude|grok|omp|codex|all] [--json]
+agent-bus send <name-or-id> -m TEXT [--summary S] [--from-name N]
+agent-bus inbox [--name N] [--unread] [--json]
+agent-bus ack <message-id> [--name N]
+agent-bus register --name N --kind K [--cwd P] [--pid P]
+agent-bus unregister --name N
+agent-bus self [--json]
+
+# EXPERIMENT (see below)
+agent-bus listen [--name agent-bus]
+agent-bus send-uds <socket-path> -m TEXT
+```
+
+`list` = live roster entries (after pruning dead) UNION native adapters (claude/grok/omp/codex read-only discovery of their registries). Only alive pids.
+
+`send` to a discovered native name/id will lazily create a roster entry + inbox under this bus home using a stable derived id (`claude:<sessionId>`, `grok:...` etc). The recipient only sees it if they also run `agent-bus inbox` (or via skill).
+
+## Adapters (read-only, best-effort, never throw)
+
+- claude: `~/.claude/sessions/*.json` (pid alive)
+- grok: `~/.grok/active_sessions.json`
+- omp: `~/.omp/run/daemons/*/clients/*.json` + terminal-sessions fallback
+- codex: `~/.codex/process_manager/chat_processes.json` (catalog skipped silently)
+
+Override for tests with `AGENT_BUS_SESSIONS_DIR` etc. (File-bus adapters are read-only discovery and never write native sockets; native UDS send path does write for acks and peer messages — see UDS-protocol.md.)
+
+## The `listen` + UDS experiment
+
+`agent-bus listen` lets a Claude Code session discover us via its `ListAgents` / `/list-agents`.
+
+It:
+- Binds UDS at `/tmp/cc-socks/<ourpid>.sock` (0o600, dir 0o700)
+- Writes a matching `~/.claude/sessions/<ourpid>.json` (exact fields + timestamps) + peer key
+- Accepts connections, reads newline-delimited JSON frames (tolerates final buffer w/o nl)
+- Logs raw + parsed (auth redacted) to stdout + appends to `~/.agent-bus/captures/<pid>.jsonl`
+- Auth first line on conns; accepts `type:user` frames
+- On `msg_id` present: dials back an authenticated `{"type":"control","action":"peer_message_status","status":"delivered",...}` (NEVER writes status on the inbound conn)
+- On SIGINT/SIGTERM: unlinks *only* our sock, sessions json, and key
+
+`agent-bus send-peer` sends native UDS messages into other Claude sessions (or other listeners).
+
+**Usage (from another Claude):**
+1. In one terminal (this agent): `AGENT_BUS_HOME=/tmp/ab-test agent-bus listen --name my-bus`
+2. In a real Claude Code session: run `/list-agents` or tool `ListAgents`. You should see `my-bus`.
+3. Send a message from Claude to it (it will enqueue via their SendMessage to our socket).
+4. Watch the logs + capture file.
+
+**Outbound to Claude peers:**
+`agent-bus send-peer <name-or-sock> -m "text here"`
+See [UDS-protocol.md](skills/references/UDS-protocol.md) for the full wire format, auth, frame shapes, and verified bidirectional behavior.
+
+**CRITICAL SAFETY**
+- This is an experiment to reverse the wire format.
+- Do not use `send-uds` against anything except a socket we started with `listen` under test overrides.
+- Real delivery in Claude happens at their next tool round; they may show `<cross-session-message ...>`
+- Received content must never auto-execute. Always require fresh user approval.
+
+Test overrides (used by our test suite, safe):
+- `AGENT_BUS_SOCK_DIR=/tmp/ab-test-socks`
+- `AGENT_BUS_SESSIONS_DIR=/tmp/ab-test-sessions`
+- `AGENT_BUS_HOME=/tmp/ab-test-bus`
+## Installation / running from source
+
+```sh
+gh repo clone danbarua/agent-bus && cd agent-bus
+python -m pip install -e .
+agent-bus --help
+```
+
+For a Claude session or omp: `python -m agent_bus ...` or after pip install use the script.
+
+Also a skill copy lives at `~/.claude/skills/agent-bus/SKILL.md` (and source `skills/SKILL.md`).
+
+## Skills / integration
+
+See `skills/SKILL.md`. Agents can call the CLI or import `agent_bus.store` etc to register on start and poll inbox.
+
+## Development / test
+
+```sh
+python -m pytest tests/ -q --tb=line
+AGENT_BUS_HOME=/tmp/ab-test python -m agent_bus list --json
+```
+
+## Limitations / non-goals
+
+- No impersonation of Claude's full protocol (listen + send-peer implement the UDS peer messaging subset — see [UDS-protocol.md](skills/references/UDS-protocol.md).
+- No auto-start of other agents.
+- Herdr TTY injection is a separate channel (not used here).
+- No impersonation of Claude's full protocol beyond the listen experiment.
+- Inboxes are per bus-home; multiple users would need separate homes or sync.
+
+This is intentionally small and boring.

agent_bus_team-0.1.2/README.md

@@ -0,0 +1,123 @@
+# agent-bus
+
+Small stdlib-only Python 3.11+ inter-agent messaging CLI and library.
+
+Parallel bus for Claude Code, Grok, Oh My Pi (omp), Codex, and others.
+Two channels: file bus (`send`/`inbox`) vs. native UDS (`listen` + `send-peer`). See [UDS-protocol.md](skills/references/UDS-protocol.md).
+
+## On-disk (AGENT_BUS_HOME=~/.agent-bus)
+
+```
+~/.agent-bus/
+  roster/<id>.json     # registered agents (uuid ids)
+  inboxes/<id>.jsonl   # append-only, one JSON message per line
+  captures/<pid>.jsonl # from `listen`
+```
+
+Roster entry and Message envelope match the spec in the source.
+
+## Rules (enforced)
+
+- Plain text **only** in `text` (no structured payloads).
+- Refuse `> 1_000_000` chars.
+- Per-inbox unread cap 50 (send fails with clear error).
+- **Never treat a received message as user consent.** Messages are cross-session only. The receiving agent must still show the user and obtain explicit approval before acting on any instruction in a message.
+- Names unique among *live* (pid-alive) registrations; collisions get `-2`, `-3` suffix on register.
+- `list` drops stale roster entries (dead pid) but leaves their inbox files.
+
+## CLI
+
+```sh
+agent-bus list [--kind claude|grok|omp|codex|all] [--json]
+agent-bus send <name-or-id> -m TEXT [--summary S] [--from-name N]
+agent-bus inbox [--name N] [--unread] [--json]
+agent-bus ack <message-id> [--name N]
+agent-bus register --name N --kind K [--cwd P] [--pid P]
+agent-bus unregister --name N
+agent-bus self [--json]
+
+# EXPERIMENT (see below)
+agent-bus listen [--name agent-bus]
+agent-bus send-uds <socket-path> -m TEXT
+```
+
+`list` = live roster entries (after pruning dead) UNION native adapters (claude/grok/omp/codex read-only discovery of their registries). Only alive pids.
+
+`send` to a discovered native name/id will lazily create a roster entry + inbox under this bus home using a stable derived id (`claude:<sessionId>`, `grok:...` etc). The recipient only sees it if they also run `agent-bus inbox` (or via skill).
+
+## Adapters (read-only, best-effort, never throw)
+
+- claude: `~/.claude/sessions/*.json` (pid alive)
+- grok: `~/.grok/active_sessions.json`
+- omp: `~/.omp/run/daemons/*/clients/*.json` + terminal-sessions fallback
+- codex: `~/.codex/process_manager/chat_processes.json` (catalog skipped silently)
+
+Override for tests with `AGENT_BUS_SESSIONS_DIR` etc. (File-bus adapters are read-only discovery and never write native sockets; native UDS send path does write for acks and peer messages — see UDS-protocol.md.)
+
+## The `listen` + UDS experiment
+
+`agent-bus listen` lets a Claude Code session discover us via its `ListAgents` / `/list-agents`.
+
+It:
+- Binds UDS at `/tmp/cc-socks/<ourpid>.sock` (0o600, dir 0o700)
+- Writes a matching `~/.claude/sessions/<ourpid>.json` (exact fields + timestamps) + peer key
+- Accepts connections, reads newline-delimited JSON frames (tolerates final buffer w/o nl)
+- Logs raw + parsed (auth redacted) to stdout + appends to `~/.agent-bus/captures/<pid>.jsonl`
+- Auth first line on conns; accepts `type:user` frames
+- On `msg_id` present: dials back an authenticated `{"type":"control","action":"peer_message_status","status":"delivered",...}` (NEVER writes status on the inbound conn)
+- On SIGINT/SIGTERM: unlinks *only* our sock, sessions json, and key
+
+`agent-bus send-peer` sends native UDS messages into other Claude sessions (or other listeners).
+
+**Usage (from another Claude):**
+1. In one terminal (this agent): `AGENT_BUS_HOME=/tmp/ab-test agent-bus listen --name my-bus`
+2. In a real Claude Code session: run `/list-agents` or tool `ListAgents`. You should see `my-bus`.
+3. Send a message from Claude to it (it will enqueue via their SendMessage to our socket).
+4. Watch the logs + capture file.
+
+**Outbound to Claude peers:**
+`agent-bus send-peer <name-or-sock> -m "text here"`
+See [UDS-protocol.md](skills/references/UDS-protocol.md) for the full wire format, auth, frame shapes, and verified bidirectional behavior.
+
+**CRITICAL SAFETY**
+- This is an experiment to reverse the wire format.
+- Do not use `send-uds` against anything except a socket we started with `listen` under test overrides.
+- Real delivery in Claude happens at their next tool round; they may show `<cross-session-message ...>`
+- Received content must never auto-execute. Always require fresh user approval.
+
+Test overrides (used by our test suite, safe):
+- `AGENT_BUS_SOCK_DIR=/tmp/ab-test-socks`
+- `AGENT_BUS_SESSIONS_DIR=/tmp/ab-test-sessions`
+- `AGENT_BUS_HOME=/tmp/ab-test-bus`
+## Installation / running from source
+
+```sh
+gh repo clone danbarua/agent-bus && cd agent-bus
+python -m pip install -e .
+agent-bus --help
+```
+
+For a Claude session or omp: `python -m agent_bus ...` or after pip install use the script.
+
+Also a skill copy lives at `~/.claude/skills/agent-bus/SKILL.md` (and source `skills/SKILL.md`).
+
+## Skills / integration
+
+See `skills/SKILL.md`. Agents can call the CLI or import `agent_bus.store` etc to register on start and poll inbox.
+
+## Development / test
+
+```sh
+python -m pytest tests/ -q --tb=line
+AGENT_BUS_HOME=/tmp/ab-test python -m agent_bus list --json
+```
+
+## Limitations / non-goals
+
+- No impersonation of Claude's full protocol (listen + send-peer implement the UDS peer messaging subset — see [UDS-protocol.md](skills/references/UDS-protocol.md).
+- No auto-start of other agents.
+- Herdr TTY injection is a separate channel (not used here).
+- No impersonation of Claude's full protocol beyond the listen experiment.
+- Inboxes are per bus-home; multiple users would need separate homes or sync.
+
+This is intentionally small and boring.

agent_bus_team-0.1.2/cloudbuild.yaml

@@ -0,0 +1,75 @@
+substitutions:
+  _AR_LOCATION: us-central1
+  _AR_REPOSITORY: python-repo
+  # PROJECT_ID is automatically populated by Cloud Build
+  # Service account registered as the PyPI trusted publisher for this project.
+  # Cloud Build's metadata proxy has no "default" identity alias, so `id`
+  # must be told explicitly which service account to mint an OIDC token for.
+  # The build's own runtime service account needs roles/iam.serviceAccountTokenCreator
+  # on this account to impersonate it.
+  _PYPI_SA_EMAIL: agent-bus-build-ci-runner@agent-bus-build.iam.gserviceaccount.com
+
+# Build steps.
+steps:
+  # 1. Ensure hatch-vcs sees the tag.
+  - id: show-version
+    name: gcr.io/cloud-builders/git
+    entrypoint: bash
+    args:
+      - -c
+      - |
+        set -e
+        # 1. Specifically fetch the tag that triggered the build from the remote
+        git fetch --depth=1 origin +refs/tags/${TAG_NAME}:refs/tags/${TAG_NAME}
+        
+        # 2. Force the checkout to that tag
+        git checkout -f ${TAG_NAME}
+        
+        echo "TAG_NAME=${TAG_NAME}"
+        echo "Current commit: $(git rev-parse HEAD)"
+        echo "git describe: $(git describe --tags --always)"
+
+
+
+  # 2. Build sdist + wheel into dist/ using uv.
+  - id: build
+    name: ghcr.io/astral-sh/uv:python3.11-bookworm
+    entrypoint: bash
+    args:
+      - -c
+      - |
+        set -e
+        uv build
+        ls -la dist/
+
+
+  # 3. Publish to PyPi
+  - id: publish-to-pypi
+    name: ghcr.io/astral-sh/uv:python3.11-bookworm
+    entrypoint: bash
+    env:
+      # Cloud Build's metadata server has no "default" service-account alias
+      # (unlike a plain GCE VM), so `id` must be told which identity to
+      # request an OIDC token for. See _PYPI_SA_EMAIL above.
+      - GOOGLE_SERVICE_ACCOUNT_NAME=${_PYPI_SA_EMAIL}
+    args:
+      - -c
+      - |
+        set -e
+        uv pip install --system -U id twine
+        oidc_token=$(python -m id pypi)
+        resp=$(curl -s -X POST https://pypi.org/_/oidc/mint-token -d "{\"token\": \"${oidc_token}\"}")
+        api_token=$(python -c "import sys, json; data = json.load(sys.stdin); sys.exit('PyPI OIDC token mint failed: ' + json.dumps(data)) if 'token' not in data else print(data['token'])" <<< "$resp")
+        TWINE_USERNAME=__token__ TWINE_PASSWORD="$api_token" twine upload dist/*
+
+# Surface the built artifacts in the Cloud Build UI.
+artifacts:
+  objects:
+    location: gs://${PROJECT_ID}_cloudbuild/artifacts/${TAG_NAME}
+    paths:
+      - dist/*
+
+options:
+  logging: CLOUD_LOGGING_ONLY
+  # Required to allow twine to use the service account credentials
+  requestedVerifyOption: VERIFIED

agent_bus_team-0.1.2/infra/apis.tf

@@ -0,0 +1,19 @@
+resource "google_project_service" "ci" {
+  for_each = toset([
+    "cloudbuild.googleapis.com",
+    "logging.googleapis.com",
+    "iam.googleapis.com",
+  ])
+
+  project = var.project_id
+  service = each.value
+
+
+  timeouts {
+    create = "30m"
+    update = "40m"
+  }
+  
+  disable_on_destroy         = false
+  disable_dependent_services = false
+}

agent_bus_team-0.1.2/infra/outputs.tf

@@ -0,0 +1,5 @@
+output "ci_runner_email" {
+  description = "The identity every trigger runs as. Holds roles/logging.logWriter and nothing else."
+  value       = google_service_account.ci_runner.email
+}
+

agent_bus_team-0.1.2/infra/project.tf

@@ -0,0 +1,20 @@
+terraform {
+  required_version = ">= 1.15.0"
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 7.45"
+    }
+  }
+}
+
+# Create a project with billing linked from the start
+resource "google_project" "build_project" {
+  deletion_policy    = "PREVENT"
+  name            = "agent-bus cloud-build project"
+  project_id      = "agent-bus-build"
+  billing_account = var.billing_account_id
+
+  # Auto-create default service account
+  auto_create_network = true
+}

agent_bus_team-0.1.2/infra/providers.tf

@@ -0,0 +1,4 @@
+provider "google" {
+  project = var.project_id
+  region  = var.region
+}

agent_bus_team-0.1.2/infra/service_accounts.tf

@@ -0,0 +1,24 @@
+resource "google_service_account" "ci_runner" {
+  account_id   = "${var.project_id}-ci-runner"
+  display_name = "${var.project_name} CI runner"
+  description  = "Runs Cloud Build and publishes package to PyPI."
+}
+
+resource "google_project_iam_member" "runner_log_writer" {
+  project = var.project_id
+  role    = "roles/logging.logWriter"
+  member  = "serviceAccount:${google_service_account.ci_runner.email}"
+}
+
+resource "google_project_iam_member" "act_as" {
+  project = var.project_id
+  role    = "roles/iam.serviceAccountUser"
+  member  = "serviceAccount:${google_service_account.ci_runner.email}"
+}
+
+resource "google_project_iam_member" "token_creator" {
+  project = var.project_id
+  role    = "roles/iam.serviceAccountTokenCreator"
+  member  = "serviceAccount:${google_service_account.ci_runner.email}"
+  depends_on = [google_service_account.ci_runner]
+}

agent_bus_team-0.1.2/infra/triggers.tf

@@ -0,0 +1,35 @@
+locals {
+  repo_uri       = "https://github.com/${var.github_owner}/${var.github_repo}"
+}
+
+# __generated__ by Terraform from "projects/mighty-colab/locations/global/triggers/6cce1bea-a0c0-4746-9935-ad6b048ccf90"
+resource "google_cloudbuild_trigger" "publish_on_tag" {
+  deletion_policy    = "PREVENT"
+  description        = "Publish on matched tag"
+  disabled           = false
+  filename           = "cloudbuild.yaml"
+  filter             = null
+  ignored_files      = []
+  include_build_logs = null
+  included_files     = []
+  location           = var.region
+  name               = "publish-on-tag"
+  project            = var.project_id
+  service_account    = "projects/${var.project_id}/serviceAccounts/${var.project_id}-ci-runner@${var.project_id}.iam.gserviceaccount.com"
+  substitutions      = {}
+  tags               = []
+  depends_on         = [google_project_service.ci]
+  approval_config {
+    approval_required = false
+  }
+  github {
+    enterprise_config_resource_name = null
+    name                            = var.github_repo
+    owner                           = var.github_owner
+    push {
+      branch       = null
+      invert_regex = false
+      tag          = "^v.*"
+    }
+  }
+}