agent-starter-pack 0.18.0__tar.gz → 0.18.2__tar.gz

{agent_starter_pack-0.18.0 → agent_starter_pack-0.18.2}/.cloudbuild/terraform/backend.tf

@@ -1,6 +1,6 @@
 terraform {
   backend "gcs" {
-    bucket = "agent-starter-pack-cicd-terraform-state"
+    bucket = "asp-e2e-cicd-terraform-state"
     prefix = "cloudbuild"
   }
 }

{agent_starter_pack-0.18.0 → agent_starter_pack-0.18.2}/.cloudbuild/terraform/build_triggers.tf

@@ -403,7 +403,7 @@ resource "google_cloudbuild_trigger" "pr_test_makefile" {
 
   filename           = ".cloudbuild/ci/test_makefile.yaml"
   included_files     = local.makefile_usability_included_files
-  ignored_files      = local.common_ignored_files
+  ignored_files      = ["**/*.md"]  # Don't ignore Makefiles for this trigger
   include_build_logs = "INCLUDE_BUILD_LOGS_WITH_STATUS"
 }
 

{agent_starter_pack-0.18.0 → agent_starter_pack-0.18.2}/.cloudbuild/terraform/variables.tf

@@ -46,11 +46,11 @@ variable "cleanup_project_ids" {
   description = "List of all project IDs that need cleanup (for scheduled cleanup job)"
   type        = list(string)
   default = [
-    "agent-starter-pack-e2e-dev",
-    "agent-starter-pack-e2e-st",
-    "agent-starter-pack-e2e-pr",
-    "asp-starter-dev",
-    "asp-starter-prod",
-    "asp-starter-staging"
+    "asp-e2e-dev",
+    "asp-e2e-stg",
+    "asp-e2e-prd",
+    "asp-test-dev",
+    "asp-test-prd",
+    "asp-test-stg"
   ]
 }

agent_starter_pack-0.18.2/.cloudbuild/terraform/vars/env.tfvars

@@ -0,0 +1,13 @@
+cicd_runner_project_id = "asp-e2e-cicd"
+
+region = "europe-west4"
+
+host_connection_name = "git-connection"
+
+repository_name = "GoogleCloudPlatform-agent-starter-pack"
+
+e2e_test_project_mapping = {
+  dev     = "asp-e2e-dev"
+  staging = "asp-e2e-stg"
+  prod    = "asp-e2e-prd"
+}

{agent_starter_pack-0.18.0 → agent_starter_pack-0.18.2}/GEMINI.md

@@ -166,6 +166,91 @@ Test changes across multiple dimensions:
 -   [ ] **CI/CD Parity:** Changes applied to both GitHub Actions and Cloud Build?
 -   [ ] **Multi-Agent Testing:** Tested with different agent types and configurations?
 
+## Pull Request Best Practices
+
+When creating pull requests for this repository, follow these guidelines for clear, professional commits and PR descriptions.
+
+### Commit Message Format
+```
+<type>: <concise summary in imperative mood>
+
+<detailed explanation of the change>
+- Why the change was needed
+- What was the root cause
+- How the fix addresses it
+```
+
+**Types**: `fix`, `feat`, `refactor`, `docs`, `test`, `chore`
+
+### PR Structure Example
+
+**Title:** Brief, descriptive summary (50-60 chars)
+```
+Fix Cloud Build service account permission for GitHub PAT secret access
+```
+
+**Description:**
+```markdown
+## Summary
+- Key change 1 (what was added/modified)
+- Key change 2
+- Key change 3
+
+## Problem
+Clear description of the issue, including:
+- Error messages or symptoms
+- Why it was failing
+- Context about when/where it occurs
+
+## Solution
+Explanation of how the changes fix the problem:
+- What resources/files were modified
+- Why this approach was chosen
+- Any dependencies or sequencing requirements
+```
+
+### Example (based on actual PR)
+
+**Commit:**
+```
+Fix Cloud Build service account permission for GitHub PAT secret access
+
+Add IAM binding to grant Cloud Build service account the secretAccessor
+role for the GitHub PAT secret. This resolves permission errors when
+Terraform creates Cloud Build v2 connections in E2E tests.
+
+The CLI setup already grants this permission via gcloud, but the
+Terraform configuration was missing this binding, causing failures when
+Terraform runs independently.
+```
+
+**PR Description:**
+```markdown
+## Summary
+- Grant Cloud Build service account `secretmanager.secretAccessor` role
+- Add proper dependency to Cloud Build v2 connection resource
+
+## Problem
+E2E tests failed when Terraform attempted to create Cloud Build v2 connections:
+```
+Error: could not access secret with service account:
+generic::permission_denied
+```
+
+The CLI setup grants this permission via gcloud, but Terraform
+configuration lacked the IAM binding.
+
+## Solution
+Added `google_secret_manager_secret_iam_member` resource to grant the
+Cloud Build service account permission to access the GitHub PAT secret
+before creating the connection.
+```
+
+### Key Principles
+- **Concise but complete**: Provide enough context for reviewers
+- **Problem-first**: Explain the "why" before the "what"
+- **Professional tone**: Avoid mentions of AI tools or assistants
+
 ### Key Tooling
 
 -   **`uv` for Python:** Primary tool for dependency management and CLI execution

{agent_starter_pack-0.18.0 → agent_starter_pack-0.18.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-starter-pack
-Version: 0.18.0
+Version: 0.18.2
 Summary: CLI to bootstrap production-ready Google Cloud GenAI agent projects from templates.
 Author-email: Google LLC <agent-starter-pack@google.com>
 License: Apache-2.0

{agent_starter_pack-0.18.0 → agent_starter_pack-0.18.2}/agent_starter_pack/base_template/Makefile

@@ -156,9 +156,9 @@ playground-dev:
 
 # Deploy the agent remotely
 {%- if cookiecutter.deployment_target == 'cloud_run' %}
-# Usage: make backend [IAP=true] [PORT=8080] - Set IAP=true to enable Identity-Aware Proxy, PORT to specify container port
+# Usage: make deploy [IAP=true] [PORT=8080] - Set IAP=true to enable Identity-Aware Proxy, PORT to specify container port
 {%- endif %}
-backend:
+deploy:
 {%- if cookiecutter.deployment_target == 'cloud_run' %}
 	PROJECT_ID=$$(gcloud config get-value project) && \
 	gcloud beta run deploy {{cookiecutter.project_name}} \
@@ -179,6 +179,9 @@ backend:
 	uv export --no-hashes --no-header --no-dev --no-emit-project > .requirements.txt && uv run {{cookiecutter.agent_directory}}/agent_engine_app.py
 {%- endif %}
 
+# Alias for 'make deploy' for backward compatibility
+backend: deploy
+
 
 # ==============================================================================
 # Infrastructure Setup
@@ -235,13 +238,8 @@ lint:
 # ==============================================================================
 
 # Register the deployed agent to Gemini Enterprise
-# Usage: make register-gemini-enterprise GEMINI_ENTERPRISE_APP_ID=projects/{project_number}/locations/{location}/collections/{collection}/engines/{engine_id} [AGENT_ENGINE_ID=<id>]  # Defaults to deployment_metadata.json
+# Usage: make register-gemini-enterprise ARGS="--gemini-enterprise-app-id=xxx --display-name='My Agent'"
+# Or set environment variables: GEMINI_ENTERPRISE_APP_ID, GEMINI_DISPLAY_NAME, GEMINI_DESCRIPTION, etc.
 register-gemini-enterprise:
-	uvx --from agent-starter-pack agent-starter-pack-register-gemini-enterprise \
-		$(if $(GEMINI_ENTERPRISE_APP_ID),--gemini-enterprise-app-id="$(GEMINI_ENTERPRISE_APP_ID)",) \
-		$(if $(AGENT_ENGINE_ID),--agent-engine-id="$(AGENT_ENGINE_ID)",) \
-		$(if $(GEMINI_DISPLAY_NAME),--display-name="$(GEMINI_DISPLAY_NAME)",) \
-		$(if $(GEMINI_DESCRIPTION),--description="$(GEMINI_DESCRIPTION)",) \
-		$(if $(GEMINI_TOOL_DESCRIPTION),--tool-description="$(GEMINI_TOOL_DESCRIPTION)",) \
-		$(if $(GEMINI_AUTHORIZATION_ID),--authorization-id="$(GEMINI_AUTHORIZATION_ID)",)
+	uvx --from agent-starter-pack agent-starter-pack-register-gemini-enterprise $(ARGS)
 {%- endif %}

{agent_starter_pack-0.18.0 → agent_starter_pack-0.18.2}/agent_starter_pack/base_template/README.md

@@ -59,11 +59,11 @@ make install && make playground
 {%- endif %}
 {%- if cookiecutter.deployment_target == 'cloud_run' %}
 | `make playground`    | Launch local development environment with backend and frontend{%- if cookiecutter.is_adk %} - leveraging `adk web` command. {%- endif %}|
-| `make backend`       | Deploy agent to Cloud Run (use `IAP=true` to enable Identity-Aware Proxy, `PORT=8080` to specify container port) |
+| `make deploy`        | Deploy agent to Cloud Run (use `IAP=true` to enable Identity-Aware Proxy, `PORT=8080` to specify container port) |
 | `make local-backend` | Launch local development server with hot-reload |
 {%- elif cookiecutter.deployment_target == 'agent_engine' %}
 | `make playground`    | Launch Streamlit interface for testing agent locally and remotely |
-| `make backend`       | Deploy agent to Agent Engine |
+| `make deploy`        | Deploy agent to Agent Engine |
 {%- if cookiecutter.is_adk_live %}
 | `make local-backend` | Launch local development server with hot-reload |
 | `make ui`            | Start the frontend UI separately for development (requires backend running separately) |
@@ -160,10 +160,10 @@ You can test deployment towards a Dev Environment using the following command:
 
 ```bash
 gcloud config set project <your-dev-project-id>
-make backend
+make deploy
 ```
 {% if cookiecutter.is_adk_live %}
-**Note:** For secure access to your deployed backend, consider using Identity-Aware Proxy (IAP) by running `make backend IAP=true`.
+**Note:** For secure access to your deployed backend, consider using Identity-Aware Proxy (IAP) by running `make deploy IAP=true`.
 {%- endif %}
 
 The repository includes a Terraform configuration for the setup of the Dev Google Cloud project.

{agent_starter_pack-0.18.0 → agent_starter_pack-0.18.2}/agent_starter_pack/base_template/deployment/terraform/github.tf

@@ -276,6 +276,20 @@ data "google_secret_manager_secret" "github_pat" {
   secret_id = var.github_pat_secret_id
 }
 
+# Get CICD project data for Cloud Build service account
+data "google_project" "cicd_project" {
+  project_id = var.cicd_runner_project_id
+}
+
+# Grant Cloud Build service account access to GitHub PAT secret
+resource "google_secret_manager_secret_iam_member" "cloudbuild_secret_accessor" {
+  project   = var.cicd_runner_project_id
+  secret_id = data.google_secret_manager_secret.github_pat.secret_id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:service-${data.google_project.cicd_project.number}@gcp-sa-cloudbuild.iam.gserviceaccount.com"
+  depends_on = [resource.google_project_service.cicd_services]
+}
+
 # Create the GitHub connection (fallback for manual Terraform usage)
 resource "google_cloudbuildv2_connection" "github_connection" {
   count      = var.create_cb_connection ? 0 : 1
@@ -289,7 +303,11 @@ resource "google_cloudbuildv2_connection" "github_connection" {
       oauth_token_secret_version = "${data.google_secret_manager_secret.github_pat.id}/versions/latest"
     }
   }
-  depends_on = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
+  depends_on = [
+    resource.google_project_service.cicd_services,
+    resource.google_project_service.deploy_project_services,
+    resource.google_secret_manager_secret_iam_member.cloudbuild_secret_accessor
+  ]
 }
 
 

{agent_starter_pack-0.18.0 → agent_starter_pack-0.18.2}/agent_starter_pack/data_ingestion/data_ingestion_pipeline/submit_pipeline.py

@@ -17,6 +17,7 @@ import logging
 import os
 import sys
 
+import backoff
 from data_ingestion_pipeline.pipeline import pipeline
 from google.cloud import aiplatform
 from kfp import compiler
@@ -136,6 +137,22 @@ def parse_args() -> argparse.Namespace:
     return parsed_args
 
 
+@backoff.on_exception(
+    backoff.expo,
+    Exception,
+    max_tries=3,
+    max_time=3600,
+    on_backoff=lambda details: logging.warning(
+        f"Pipeline attempt {details['tries']} failed, retrying in {details['wait']:.1f}s..."
+    ),
+)
+def submit_and_wait_pipeline(pipeline_job_params: dict, service_account: str) -> None:
+    """Submit pipeline job and wait for completion with retry logic."""
+    job = aiplatform.PipelineJob(**pipeline_job_params)
+    job.submit(service_account=service_account)
+    job.wait()
+
+
 if __name__ == "__main__":
     args = parse_args()
 
@@ -182,17 +199,14 @@ if __name__ == "__main__":
     )
 {%- endif %}
 
-    # Create pipeline job instance
-    job = aiplatform.PipelineJob(**pipeline_job_params)
-
     if not args.schedule_only:
         logging.info("Running pipeline and waiting for completion...")
-        job.submit(service_account=args.service_account)
-        job.wait()
+        submit_and_wait_pipeline(pipeline_job_params, args.service_account)
         logging.info("Pipeline completed!")
 
     if args.cron_schedule and args.schedule_only:
-        # No need to create new job instance since we already have one with the same params
+        # Create pipeline job instance for scheduling
+        job = aiplatform.PipelineJob(**pipeline_job_params)
         pipeline_job_schedule = aiplatform.PipelineJobSchedule(
             pipeline_job=job,
             display_name=f"{args.pipeline_name} Weekly Ingestion Job",

{agent_starter_pack-0.18.0 → agent_starter_pack-0.18.2}/agent_starter_pack/data_ingestion/pyproject.toml

@@ -5,6 +5,7 @@ description = "Data ingestion pipeline for RAG retriever"
 readme = "README.md"
 requires-python = ">=3.9, <=3.13"
 dependencies = [
+    "backoff>=2.2.0",
     "google-cloud-aiplatform>=1.80.0",
     "google-cloud-pipeline-components>=2.19.0",
     "kfp>=1.4.0",