agent-starter-pack 0.17.5__tar.gz → 0.18.1__tar.gz

{agent_starter_pack-0.17.5 → agent_starter_pack-0.18.1}/.claude/settings.local.json

@@ -27,7 +27,15 @@
       "Bash(export _TEST_AGENT_COMBINATION=adk_live,agent_engine)",
       "Bash(make lint-templated-agents)",
       "Bash(mkdir -p agent-starter-pack)",
-      "Bash(ls -la \"agent_starter_pack/base_template/{% if cookiecutter.cicd_runner == ''google_cloud_build'' %}.cloudbuild{% else %}unused_.cloudbuild{% endif %}/\")"
+      "Bash(ls -la \"agent_starter_pack/base_template/{% if cookiecutter.cicd_runner == ''google_cloud_build'' %}.cloudbuild{% else %}unused_.cloudbuild{% endif %}/\")",
+      "Bash(PROJECT_IDS=asp-starter-dev,asp-starter-prod,asp-starter-staging python3 tests/cicd/scripts/delete_agent_engines.py)",
+      "Bash(PROJECT_IDS=agent-starter-pack-e2e-dev,agent-starter-pack-e2e-st,agent-starter-pack-e2e-pr python3 tests/cicd/scripts/delete_vector_search.py)",
+      "Bash(PROJECT_IDS=asp-starter-dev,asp-starter-prod,asp-starter-staging python3 tests/cicd/scripts/delete_alloydb_clusters.py)",
+      "Bash(PROJECT_IDS=asp-starter-dev,asp-starter-prod,asp-starter-staging python3 tests/cicd/scripts/delete_service_accounts.py)",
+      "Bash(PROJECT_IDS=asp-starter-dev,asp-starter-prod,asp-starter-staging python3 tests/cicd/scripts/delete_vector_search.py)",
+      "Bash(chmod +x /Users/eliasecchi/Development/agent-starter-pack/force-cleanup.sh)",
+      "Bash(terraform plan -var-file=vars/env.tfvars)",
+      "Bash(uv run pytest \"tests/unit/test_makefile_template.py::TestMakefileGeneration::test_makefile_hash[adk_base_agent_engine_no_data]\" -v)"
     ],
     "deny": [],
     "ask": []

agent_starter_pack-0.18.1/.cloudbuild/cd/test_gemini_enterprise.yaml

@@ -0,0 +1,54 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+steps:
+  # Sync dependencies
+  - name: "europe-west4-docker.pkg.dev/production-ai-template/starter-pack/e2e-tests"
+    id: install-dependencies
+    entrypoint: /bin/bash
+    args:
+      - "-c"
+      - |
+        uv sync --dev --locked
+
+  # Set gcloud project to dev environment
+  - name: "europe-west4-docker.pkg.dev/production-ai-template/starter-pack/e2e-tests"
+    id: set-gcloud-project
+    entrypoint: /bin/bash
+    args:
+      - "-c"
+      - |
+        gcloud config set project ${_E2E_DEV_PROJECT}
+
+  # Run Gemini Enterprise registration test
+  - name: "europe-west4-docker.pkg.dev/production-ai-template/starter-pack/e2e-tests"
+    id: gemini-enterprise-test
+    entrypoint: /bin/bash
+    args:
+      - "-c"
+      - |
+        uv run pytest tests/cicd/test_gemini_enterprise_registration.py -v
+    secretEnv: ['GEMINI_ENTERPRISE_APP_ID']
+
+availableSecrets:
+  secretManager:
+  - versionName: projects/$PROJECT_ID/secrets/gemini-enterprise-app-id/versions/latest
+    env: 'GEMINI_ENTERPRISE_APP_ID'
+
+logsBucket: gs://${PROJECT_ID}-logs-data/build-logs
+options:
+  defaultLogsBucketBehavior: REGIONAL_USER_OWNED_BUCKET
+  env:
+    - "RUN_GEMINI_ENTERPRISE_TEST=1"
+timeout: 3600s  # 1 hour timeout

agent_starter_pack-0.18.1/.cloudbuild/scheduled-cleanup.yaml

@@ -0,0 +1,30 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+steps:
+  # Run the force cleanup script
+  - name: "europe-west4-docker.pkg.dev/production-ai-template/starter-pack/e2e-tests"
+    id: force-cleanup
+    entrypoint: /bin/bash
+    args:
+      - "-c"
+      - |
+        chmod +x tests/cicd/scripts/force-cleanup.sh
+        ./tests/cicd/scripts/force-cleanup.sh
+
+timeout: 18000s  # 5 hour timeout for cleanup operations
+
+logsBucket: gs://${PROJECT_ID}-logs-data/build-logs
+options:
+  defaultLogsBucketBehavior: REGIONAL_USER_OWNED_BUCKET

{agent_starter_pack-0.17.5 → agent_starter_pack-0.18.1}/.cloudbuild/terraform/apis.tf

@@ -24,3 +24,25 @@ resource "google_project_service" "cloud_resource_manager_api" {
   service            = "cloudresourcemanager.googleapis.com"
   disable_on_destroy = false
 }
+
+# Enable Cloud Scheduler API for scheduled cleanup jobs
+resource "google_project_service" "cloud_scheduler_api" {
+  project            = var.cicd_runner_project_id
+  service            = "cloudscheduler.googleapis.com"
+  disable_on_destroy = false
+}
+
+# Enable Discovery Engine API for Gemini Enterprise registration tests
+# Note: You must manually create the secret "gemini-enterprise-app-id" in Secret Manager
+# with the Gemini Enterprise app resource name as the value. Example:
+# gcloud secrets create gemini-enterprise-app-id --project=<CICD_PROJECT_ID> \
+#   --data-file=<(echo -n "projects/{project_number}/locations/{location}/collections/{collection}/engines/{engine_id}")
+resource "google_project_service" "discovery_engine_api" {
+  for_each = {
+    "dev" = var.e2e_test_project_mapping.dev
+  }
+
+  project            = each.value
+  service            = "discoveryengine.googleapis.com"
+  disable_on_destroy = false
+}

{agent_starter_pack-0.17.5 → agent_starter_pack-0.18.1}/.cloudbuild/terraform/backend.tf

@@ -1,6 +1,6 @@
 terraform {
   backend "gcs" {
-    bucket = "agent-starter-pack-cicd-terraform-state"
+    bucket = "asp-e2e-cicd-terraform-state"
     prefix = "cloudbuild"
   }
 }

{agent_starter_pack-0.17.5 → agent_starter_pack-0.18.1}/.cloudbuild/terraform/build_triggers.tf

@@ -403,7 +403,7 @@ resource "google_cloudbuild_trigger" "pr_test_makefile" {
 
   filename           = ".cloudbuild/ci/test_makefile.yaml"
   included_files     = local.makefile_usability_included_files
-  ignored_files      = local.common_ignored_files
+  ignored_files      = ["**/*.md"]  # Don't ignore Makefiles for this trigger
   include_build_logs = "INCLUDE_BUILD_LOGS_WITH_STATUS"
 }
 
@@ -436,3 +436,34 @@ resource "google_cloudbuild_trigger" "pr_test_pipeline_parity" {
   ignored_files      = local.common_ignored_files
   include_build_logs = "INCLUDE_BUILD_LOGS_WITH_STATUS"
 }
+
+# i. Create E2E Gemini Enterprise Registration Test trigger for main branch commits (runs on merge to main)
+# TODO: Uncomment when ready to run remotely
+# resource "google_cloudbuild_trigger" "main_e2e_gemini_enterprise_test" {
+#   name            = "e2e-gemini-enterprise-registration"
+#   project         = var.cicd_runner_project_id
+#   location        = var.region
+#   description     = "E2E test for Gemini Enterprise registration on main branch (runs when PR merges to main)"
+#   service_account = resource.google_service_account.cicd_runner_sa.id
+#
+#   repository_event_config {
+#     repository = local.repository_path
+#     push {
+#       branch = "main"
+#     }
+#   }
+#
+#   filename       = ".cloudbuild/cd/test_gemini_enterprise.yaml"
+#   included_files = [
+#     "pyproject.toml",  # Triggers on releases
+#     "agent_starter_pack/cli/utils/register_gemini_enterprise.py",  # Registration code changes
+#     "tests/cicd/test_gemini_enterprise_registration.py",  # Test changes
+#     ".cloudbuild/cd/test_gemini_enterprise.yaml",  # Pipeline changes
+#   ]
+#   ignored_files      = local.common_ignored_files
+#   include_build_logs = "INCLUDE_BUILD_LOGS_UNSPECIFIED"
+#
+#   substitutions = {
+#     _E2E_DEV_PROJECT = var.e2e_test_project_mapping.dev
+#   }
+# }

agent_starter_pack-0.18.1/.cloudbuild/terraform/scheduled_cleanup.tf

@@ -0,0 +1,65 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Create a manual Cloud Build trigger for scheduled cleanup
+resource "google_cloudbuild_trigger" "scheduled_cleanup" {
+  name            = "scheduled-cleanup"
+  project         = var.cicd_runner_project_id
+  location        = var.region  # Must match repository connection region
+  description     = "Daily cleanup of test resources (Agent Engines, AlloyDB, Vector Search, Service Accounts)"
+  service_account = google_service_account.cicd_runner_sa.id
+
+  # Manual trigger - will be invoked by Cloud Scheduler
+  source_to_build {
+    repository = local.repository_path
+    ref        = "refs/heads/main"
+    repo_type  = "GITHUB"
+  }
+
+  filename           = ".cloudbuild/scheduled-cleanup.yaml"
+  include_build_logs = "INCLUDE_BUILD_LOGS_UNSPECIFIED"
+}
+
+# Create Cloud Scheduler job to trigger cleanup daily at 3 AM UTC
+resource "google_cloud_scheduler_job" "daily_cleanup" {
+  name             = "daily-cleanup-trigger"
+  project          = var.cicd_runner_project_id
+  region           = "europe-west1"  # Cloud Scheduler doesn't support europe-west4
+  description      = "Triggers daily cleanup of test resources at 3 AM UTC"
+  schedule         = "0 3 * * *"
+  time_zone        = "UTC"
+  attempt_deadline = "1800s"  # 30 minutes (max allowed)
+
+  http_target {
+    http_method = "POST"
+    uri         = "https://cloudbuild.googleapis.com/v1/projects/${var.cicd_runner_project_id}/locations/${var.region}/triggers/${google_cloudbuild_trigger.scheduled_cleanup.trigger_id}:run"
+
+    oauth_token {
+      service_account_email = google_service_account.cicd_runner_sa.email
+    }
+
+    # For manual triggers with source_to_build, no request body is needed
+    # The trigger configuration already specifies the source
+    body = base64encode(jsonencode({}))
+  }
+
+  retry_config {
+    retry_count = 3
+  }
+
+  depends_on = [
+    google_project_service.cloud_scheduler_api,
+    google_cloudbuild_trigger.scheduled_cleanup
+  ]
+}

{agent_starter_pack-0.17.5 → agent_starter_pack-0.18.1}/.cloudbuild/terraform/service_account.tf

@@ -59,3 +59,12 @@ resource "google_project_iam_member" "cicd_runner_e2e_project_roles" {
   role    = each.value.role
   member  = "serviceAccount:${google_service_account.cicd_runner_sa.email}"
 }
+
+# Grant owner permissions to the service account for all cleanup projects
+resource "google_project_iam_member" "cicd_runner_cleanup_project_roles" {
+  for_each = toset(var.cleanup_project_ids)
+
+  project = each.key
+  role    = "roles/owner"
+  member  = "serviceAccount:${google_service_account.cicd_runner_sa.email}"
+}

{agent_starter_pack-0.17.5 → agent_starter_pack-0.18.1}/.cloudbuild/terraform/variables.tf

@@ -41,3 +41,16 @@ variable "e2e_test_project_mapping" {
     staging = string
   })
 }
+
+variable "cleanup_project_ids" {
+  description = "List of all project IDs that need cleanup (for scheduled cleanup job)"
+  type        = list(string)
+  default = [
+    "asp-e2e-dev",
+    "asp-e2e-stg",
+    "asp-e2e-prd",
+    "asp-test-dev",
+    "asp-test-prd",
+    "asp-test-stg"
+  ]
+}

agent_starter_pack-0.18.1/.cloudbuild/terraform/vars/env.tfvars

@@ -0,0 +1,13 @@
+cicd_runner_project_id = "asp-e2e-cicd"
+
+region = "europe-west4"
+
+host_connection_name = "git-connection"
+
+repository_name = "GoogleCloudPlatform-agent-starter-pack"
+
+e2e_test_project_mapping = {
+  dev     = "asp-e2e-dev"
+  staging = "asp-e2e-stg"
+  prod    = "asp-e2e-prd"
+}

{agent_starter_pack-0.17.5 → agent_starter_pack-0.18.1}/GEMINI.md

@@ -166,6 +166,91 @@ Test changes across multiple dimensions:
 -   [ ] **CI/CD Parity:** Changes applied to both GitHub Actions and Cloud Build?
 -   [ ] **Multi-Agent Testing:** Tested with different agent types and configurations?
 
+## Pull Request Best Practices
+
+When creating pull requests for this repository, follow these guidelines for clear, professional commits and PR descriptions.
+
+### Commit Message Format
+```
+<type>: <concise summary in imperative mood>
+
+<detailed explanation of the change>
+- Why the change was needed
+- What was the root cause
+- How the fix addresses it
+```
+
+**Types**: `fix`, `feat`, `refactor`, `docs`, `test`, `chore`
+
+### PR Structure Example
+
+**Title:** Brief, descriptive summary (50-60 chars)
+```
+Fix Cloud Build service account permission for GitHub PAT secret access
+```
+
+**Description:**
+```markdown
+## Summary
+- Key change 1 (what was added/modified)
+- Key change 2
+- Key change 3
+
+## Problem
+Clear description of the issue, including:
+- Error messages or symptoms
+- Why it was failing
+- Context about when/where it occurs
+
+## Solution
+Explanation of how the changes fix the problem:
+- What resources/files were modified
+- Why this approach was chosen
+- Any dependencies or sequencing requirements
+```
+
+### Example (based on actual PR)
+
+**Commit:**
+```
+Fix Cloud Build service account permission for GitHub PAT secret access
+
+Add IAM binding to grant Cloud Build service account the secretAccessor
+role for the GitHub PAT secret. This resolves permission errors when
+Terraform creates Cloud Build v2 connections in E2E tests.
+
+The CLI setup already grants this permission via gcloud, but the
+Terraform configuration was missing this binding, causing failures when
+Terraform runs independently.
+```
+
+**PR Description:**
+```markdown
+## Summary
+- Grant Cloud Build service account `secretmanager.secretAccessor` role
+- Add proper dependency to Cloud Build v2 connection resource
+
+## Problem
+E2E tests failed when Terraform attempted to create Cloud Build v2 connections:
+```
+Error: could not access secret with service account:
+generic::permission_denied
+```
+
+The CLI setup grants this permission via gcloud, but Terraform
+configuration lacked the IAM binding.
+
+## Solution
+Added `google_secret_manager_secret_iam_member` resource to grant the
+Cloud Build service account permission to access the GitHub PAT secret
+before creating the connection.
+```
+
+### Key Principles
+- **Concise but complete**: Provide enough context for reviewers
+- **Problem-first**: Explain the "why" before the "what"
+- **Professional tone**: Avoid mentions of AI tools or assistants
+
 ### Key Tooling
 
 -   **`uv` for Python:** Primary tool for dependency management and CLI execution

{agent_starter_pack-0.17.5 → agent_starter_pack-0.18.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-starter-pack
-Version: 0.17.5
+Version: 0.18.1
 Summary: CLI to bootstrap production-ready Google Cloud GenAI agent projects from templates.
 Author-email: Google LLC <agent-starter-pack@google.com>
 License: Apache-2.0
@@ -11,6 +11,7 @@ Requires-Dist: click>=8.1.7
 Requires-Dist: cookiecutter<3.0.0,>=2.6.0
 Requires-Dist: google-cloud-aiplatform>=1.120.0
 Requires-Dist: pyyaml>=6.0.1
+Requires-Dist: requests>=2.31.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: tomli>=1.1.0; python_version < '3.11'
 Provides-Extra: jupyter
@@ -45,7 +46,7 @@ Focus on your agent logic—the starter pack provides everything else: infrastru
 
 | ⚡️ Launch | 🧪 Experiment  | ✅ Deploy | 🛠️ Customize |
 |---|---|---|---|
-| [Pre-built agent templates](./agents/) (ReAct, RAG, multi-agent, Live API). | [Vertex AI evaluation](https://cloud.google.com/vertex-ai/generative-ai/docs/models/evaluation-overview) and an interactive playground. | Production-ready infra with [monitoring, observability](https://googlecloudplatform.github.io/agent-starter-pack/guide/observability), and [CI/CD](https://googlecloudplatform.github.io/agent-starter-pack/guide/deployment) on [Cloud Run](https://cloud.google.com/run) or [Agent Engine](https://cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/overview). | Extend and customize templates according to your needs. 🆕 Now integrating with [Gemini CLI](https://github.com/google-gemini/gemini-cli) |
+| [Pre-built agent templates](./agent_starter_pack/agents/) (ReAct, RAG, multi-agent, Live API). | [Vertex AI evaluation](https://cloud.google.com/vertex-ai/generative-ai/docs/models/evaluation-overview) and an interactive playground. | Production-ready infra with [monitoring, observability](https://googlecloudplatform.github.io/agent-starter-pack/guide/observability), and [CI/CD](https://googlecloudplatform.github.io/agent-starter-pack/guide/deployment) on [Cloud Run](https://cloud.google.com/run) or [Agent Engine](https://cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/overview). | Extend and customize templates according to your needs. 🆕 Now integrating with [Gemini CLI](https://github.com/google-gemini/gemini-cli) |
 
 ---
 

{agent_starter_pack-0.17.5 → agent_starter_pack-0.18.1}/README.md

@@ -21,7 +21,7 @@ Focus on your agent logic—the starter pack provides everything else: infrastru
 
 | ⚡️ Launch | 🧪 Experiment  | ✅ Deploy | 🛠️ Customize |
 |---|---|---|---|
-| [Pre-built agent templates](./agents/) (ReAct, RAG, multi-agent, Live API). | [Vertex AI evaluation](https://cloud.google.com/vertex-ai/generative-ai/docs/models/evaluation-overview) and an interactive playground. | Production-ready infra with [monitoring, observability](https://googlecloudplatform.github.io/agent-starter-pack/guide/observability), and [CI/CD](https://googlecloudplatform.github.io/agent-starter-pack/guide/deployment) on [Cloud Run](https://cloud.google.com/run) or [Agent Engine](https://cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/overview). | Extend and customize templates according to your needs. 🆕 Now integrating with [Gemini CLI](https://github.com/google-gemini/gemini-cli) |
+| [Pre-built agent templates](./agent_starter_pack/agents/) (ReAct, RAG, multi-agent, Live API). | [Vertex AI evaluation](https://cloud.google.com/vertex-ai/generative-ai/docs/models/evaluation-overview) and an interactive playground. | Production-ready infra with [monitoring, observability](https://googlecloudplatform.github.io/agent-starter-pack/guide/observability), and [CI/CD](https://googlecloudplatform.github.io/agent-starter-pack/guide/deployment) on [Cloud Run](https://cloud.google.com/run) or [Agent Engine](https://cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/overview). | Extend and customize templates according to your needs. 🆕 Now integrating with [Gemini CLI](https://github.com/google-gemini/gemini-cli) |
 
 ---
 

{agent_starter_pack-0.17.5 → agent_starter_pack-0.18.1}/agent_starter_pack/base_template/Makefile

@@ -127,6 +127,8 @@ playground-remote: build-frontend-if-needed
 	@echo "==============================================================================="
 	uv run python -m {{cookiecutter.agent_directory}}.utils.expose_app --mode remote
 {%- endif %}
+{%- endif %}
+{%- if cookiecutter.is_adk_live and cookiecutter.deployment_target == 'agent_engine' %}
 
 # Start the frontend UI separately for development (requires backend running separately)
 ui:
@@ -154,9 +156,9 @@ playground-dev:
 
 # Deploy the agent remotely
 {%- if cookiecutter.deployment_target == 'cloud_run' %}
-# Usage: make backend [IAP=true] [PORT=8080] - Set IAP=true to enable Identity-Aware Proxy, PORT to specify container port
+# Usage: make deploy [IAP=true] [PORT=8080] - Set IAP=true to enable Identity-Aware Proxy, PORT to specify container port
 {%- endif %}
-backend:
+deploy:
 {%- if cookiecutter.deployment_target == 'cloud_run' %}
 	PROJECT_ID=$$(gcloud config get-value project) && \
 	gcloud beta run deploy {{cookiecutter.project_name}} \
@@ -177,6 +179,9 @@ backend:
 	uv export --no-hashes --no-header --no-dev --no-emit-project > .requirements.txt && uv run {{cookiecutter.agent_directory}}/agent_engine_app.py
 {%- endif %}
 
+# Alias for 'make deploy' for backward compatibility
+backend: deploy
+
 
 # ==============================================================================
 # Infrastructure Setup
@@ -226,3 +231,20 @@ lint:
 	uv run ruff check . --diff
 	uv run ruff format . --check --diff
 	uv run mypy .
+{%- if cookiecutter.is_adk and cookiecutter.deployment_target == 'agent_engine' %}
+
+# ==============================================================================
+# Gemini Enterprise Integration
+# ==============================================================================
+
+# Register the deployed agent to Gemini Enterprise
+# Usage: make register-gemini-enterprise GEMINI_ENTERPRISE_APP_ID=projects/{project_number}/locations/{location}/collections/{collection}/engines/{engine_id} [AGENT_ENGINE_ID=<id>]  # Defaults to deployment_metadata.json
+register-gemini-enterprise:
+	uvx --from agent-starter-pack agent-starter-pack-register-gemini-enterprise \
+		$(if $(GEMINI_ENTERPRISE_APP_ID),--gemini-enterprise-app-id="$(GEMINI_ENTERPRISE_APP_ID)",) \
+		$(if $(AGENT_ENGINE_ID),--agent-engine-id="$(AGENT_ENGINE_ID)",) \
+		$(if $(GEMINI_DISPLAY_NAME),--display-name="$(GEMINI_DISPLAY_NAME)",) \
+		$(if $(GEMINI_DESCRIPTION),--description="$(GEMINI_DESCRIPTION)",) \
+		$(if $(GEMINI_TOOL_DESCRIPTION),--tool-description="$(GEMINI_TOOL_DESCRIPTION)",) \
+		$(if $(GEMINI_AUTHORIZATION_ID),--authorization-id="$(GEMINI_AUTHORIZATION_ID)",)
+{%- endif %}

{agent_starter_pack-0.17.5 → agent_starter_pack-0.18.1}/agent_starter_pack/base_template/README.md

@@ -59,16 +59,21 @@ make install && make playground
 {%- endif %}
 {%- if cookiecutter.deployment_target == 'cloud_run' %}
 | `make playground`    | Launch local development environment with backend and frontend{%- if cookiecutter.is_adk %} - leveraging `adk web` command. {%- endif %}|
-| `make backend`       | Deploy agent to Cloud Run (use `IAP=true` to enable Identity-Aware Proxy) |
-| `make local-backend` | Launch local development server |
-{%- if cookiecutter.deployment_target == 'cloud_run' %}
+| `make deploy`        | Deploy agent to Cloud Run (use `IAP=true` to enable Identity-Aware Proxy, `PORT=8080` to specify container port) |
+| `make local-backend` | Launch local development server with hot-reload |
+{%- elif cookiecutter.deployment_target == 'agent_engine' %}
+| `make playground`    | Launch Streamlit interface for testing agent locally and remotely |
+| `make deploy`        | Deploy agent to Agent Engine |
 {%- if cookiecutter.is_adk_live %}
-| `make ui`       | Launch Agent Playground front-end only |
+| `make local-backend` | Launch local development server with hot-reload |
+| `make ui`            | Start the frontend UI separately for development (requires backend running separately) |
+| `make playground-dev` | Launch dev playground with both frontend and backend hot-reload |
+| `make playground-remote` | Connect to remote deployed agent with local frontend |
+| `make build-frontend` | Build the frontend for production |
 {%- endif %}
+{%- if cookiecutter.is_adk %}
+| `make register-gemini-enterprise` | Register deployed agent to Gemini Enterprise (see Makefile for parameters) |
 {%- endif %}
-{%- elif cookiecutter.deployment_target == 'agent_engine' %}
-| `make playground`    | Launch Streamlit interface for testing agent locally and remotely |
-| `make backend`       | Deploy agent to Agent Engine |
 {%- endif %}
 | `make test`          | Run unit and integration tests                                                              |
 | `make lint`          | Run code quality checks (codespell, ruff, mypy)                                             |
@@ -76,7 +81,6 @@ make install && make playground
 {%- if cookiecutter.data_ingestion %}
 | `make data-ingestion`| Run data ingestion pipeline in the Dev environment                                           |
 {%- endif %}
-| `uv run jupyter lab` | Launch Jupyter notebook                                                                     |
 
 For full command options and usage, refer to the [Makefile](Makefile).
 
@@ -156,10 +160,10 @@ You can test deployment towards a Dev Environment using the following command:
 
 ```bash
 gcloud config set project <your-dev-project-id>
-make backend
+make deploy
 ```
 {% if cookiecutter.is_adk_live %}
-**Note:** For secure access to your deployed backend, consider using Identity-Aware Proxy (IAP) by running `make backend IAP=true`.
+**Note:** For secure access to your deployed backend, consider using Identity-Aware Proxy (IAP) by running `make deploy IAP=true`.
 {%- endif %}
 
 The repository includes a Terraform configuration for the setup of the Dev Google Cloud project.

{agent_starter_pack-0.17.5 → agent_starter_pack-0.18.1}/agent_starter_pack/base_template/deployment/terraform/github.tf

@@ -276,6 +276,20 @@ data "google_secret_manager_secret" "github_pat" {
   secret_id = var.github_pat_secret_id
 }
 
+# Get CICD project data for Cloud Build service account
+data "google_project" "cicd_project" {
+  project_id = var.cicd_runner_project_id
+}
+
+# Grant Cloud Build service account access to GitHub PAT secret
+resource "google_secret_manager_secret_iam_member" "cloudbuild_secret_accessor" {
+  project   = var.cicd_runner_project_id
+  secret_id = data.google_secret_manager_secret.github_pat.secret_id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:service-${data.google_project.cicd_project.number}@gcp-sa-cloudbuild.iam.gserviceaccount.com"
+  depends_on = [resource.google_project_service.cicd_services]
+}
+
 # Create the GitHub connection (fallback for manual Terraform usage)
 resource "google_cloudbuildv2_connection" "github_connection" {
   count      = var.create_cb_connection ? 0 : 1
@@ -289,7 +303,11 @@ resource "google_cloudbuildv2_connection" "github_connection" {
       oauth_token_secret_version = "${data.google_secret_manager_secret.github_pat.id}/versions/latest"
     }
   }
-  depends_on = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
+  depends_on = [
+    resource.google_project_service.cicd_services,
+    resource.google_project_service.deploy_project_services,
+    resource.google_secret_manager_secret_iam_member.cloudbuild_secret_accessor
+  ]
 }