ci: integration check for #676 + #673 + #674 (do not merge) by fas89 · Pull Request #678 · Agenticstiger/forge-cli

feat(iac): one contract is governed the same on GCP as on AWS: retention, CMEK, column restrictions and mapped principals reach BigQuery, and fluid verify checks them

fas89

committed

6a1c099

feat(build): an embedded-SQL build on DuckDB reads BigQuery upstreams and lands in BigQuery; fluid verify counts the table and checks its masked columns

fas89

committed

f91f7d8

fix(iac,verify): a region that is not a location never reaches a key's import id, and a partial Lake Formation listing is an error, not a pass

fas89

committed

f2c87ff

fix(platform): one contract on aws and gcp keeps two states, and GCP fails closed on sovereignty

fas89

committed

6eaa58d

fix(iac): a mapped identity carrying an {{ env.* }} template validates as it will emit

fas89

committed

93de43d

chore(secrets): the baseline follows iac-tests.yml's moved line

fas89

committed

35ba1a3

fix(build): the BigQuery embedded-SQL path holds its reads and load to sovereignty, never loads into its own input, refuses outputs it cannot land, and records its load for verify

fas89

committed

96a70db

Merge origin/main into feat/gcp-platform-safety

fas89

committed

29f831d

fix(iac,validate): the review's governance defects: strict validate on AWS, restriction readers, IAM names, revocation, migration and one key per dataset

fas89

committed

8f72348

Merge origin/main (0.16.6) into feat/gcp-governance-parity

fas89

committed

7bcd695

fix(platform): a dry-run never moves state, strict GCP sovereignty fails closed on an unplaceable location, and a Pub/Sub topic keeps its region

fas89

committed

cc9784c

fix(sovereignty): a KMS key ring and a Data Catalog taxonomy are placed at their dataset's multi-region, and plan --check-sovereignty checks what apply emits

fas89

committed

fbc31fd

fix(iac): the state-key migration attributes a state by its resources' clouds, not by OpenTofu's built-in provider

fas89

committed

b321998

fix(apply): the Command Center run of a build-augmented apply says what each build did, and why the run failed

fas89

committed

093e209

fix(schedule-sync): the first sync after the env-scoped DAG layout retires the DAG it replaced

fas89

committed

6d456fc

Merge origin/main (0.16.6) into feat/gcp-platform-safety

fas89

committed

15ccfbc

docs(changelog): the first schedule-sync after the env-scoped DAG layout retires each env's old DAG

fas89

committed

b6af57e

fix(iac): a Lake Formation read grant the column restrictions leave with no column is refused, as a hand-written one is

fas89

committed

d68304a

fix(verify): BigQuery column restrictions read the table's tags before Data Catalog, and say so on the emulator

fas89

committed

d9a0cbf

refactor(apply): the current apply run lives in observability, so build_runners records builds without importing the CLI

fas89

committed

fc37787

fix(examples): the shipped examples pass the governance checks, AWS access through Lake Formation grants

fas89

committed

7aeafe4

test(iac): the byte-identity pin's refusal branch no longer names part-b, which now emits

fas89

committed

1f9dddc

Merge remote-tracking branch 'origin/main' into feat/gcp-platform-safety

fas89

committed

16705ff

docs(schedule-sync): 0.16.7 is the last release with the old DAG layout

fas89

committed

fc9adbd

Merge remote-tracking branch 'origin/main' into feat/gcp-embedded-sql-bigquery

fas89

committed

8d1e62f

Merge remote-tracking branch 'origin/main' into feat/gcp-governance-parity

fas89

committed

dc5a00c

test(iac): a restriction-derived column limit carries SELECT alone, as a hand-written one does

fas89

committed

5422bec

Merge #676 (feat/gcp-platform-safety, fc9adbd) into ci/integration-gcp-parity

fas89

committed

0c0ca8b

Merge #673 (feat/gcp-embedded-sql-bigquery, 8d1e62f) into ci/integration-gcp-parity

fas89

committed

a4feb9f

Merge #674 (feat/gcp-governance-parity, 5422bec) into ci/integration-gcp-parity

fas89

committed

a082bd8

integration: #673 on #676's undeclared BigQuery location, and #674's verify client answers #673's row count

fas89

committed

852dde4

Navigation Menu

ci: integration check for #676 + #673 + #674 (do not merge) - #678

ci: integration check for #676 + #673 + #674 (do not merge)#678
fas89 wants to merge 31 commits into
mainfrom
ci/integration-gcp-parity

Commits on Sep 28, 2026

feat(iac): one contract is governed the same on GCP as on AWS: retention, CMEK, column restrictions and mapped principals reach BigQuery, and fluid verify checks them

feat(build): an embedded-SQL build on DuckDB reads BigQuery upstreams and lands in BigQuery; fluid verify counts the table and checks its masked columns

fix(iac,verify): a region that is not a location never reaches a key's import id, and a partial Lake Formation listing is an error, not a pass

fix(platform): one contract on aws and gcp keeps two states, and GCP fails closed on sovereignty

fix(iac): a mapped identity carrying an {{ env.* }} template validates as it will emit

chore(secrets): the baseline follows iac-tests.yml's moved line

fix(build): the BigQuery embedded-SQL path holds its reads and load to sovereignty, never loads into its own input, refuses outputs it cannot land, and records its load for verify

Merge origin/main into feat/gcp-platform-safety

fix(iac,validate): the review's governance defects: strict validate on AWS, restriction readers, IAM names, revocation, migration and one key per dataset

Merge origin/main (0.16.6) into feat/gcp-governance-parity

fix(platform): a dry-run never moves state, strict GCP sovereignty fails closed on an unplaceable location, and a Pub/Sub topic keeps its region

fix(sovereignty): a KMS key ring and a Data Catalog taxonomy are placed at their dataset's multi-region, and plan --check-sovereignty checks what apply emits

fix(iac): the state-key migration attributes a state by its resources' clouds, not by OpenTofu's built-in provider

fix(apply): the Command Center run of a build-augmented apply says what each build did, and why the run failed

fix(schedule-sync): the first sync after the env-scoped DAG layout retires the DAG it replaced

Merge origin/main (0.16.6) into feat/gcp-platform-safety

docs(changelog): the first schedule-sync after the env-scoped DAG layout retires each env's old DAG

fix(iac): a Lake Formation read grant the column restrictions leave with no column is refused, as a hand-written one is

fix(verify): BigQuery column restrictions read the table's tags before Data Catalog, and say so on the emulator

refactor(apply): the current apply run lives in observability, so build_runners records builds without importing the CLI

fix(examples): the shipped examples pass the governance checks, AWS access through Lake Formation grants

test(iac): the byte-identity pin's refusal branch no longer names part-b, which now emits

Merge remote-tracking branch 'origin/main' into feat/gcp-platform-safety

docs(schedule-sync): 0.16.7 is the last release with the old DAG layout

Merge remote-tracking branch 'origin/main' into feat/gcp-embedded-sql-bigquery

Merge remote-tracking branch 'origin/main' into feat/gcp-governance-parity

test(iac): a restriction-derived column limit carries SELECT alone, as a hand-written one does

Merge #676 (feat/gcp-platform-safety, fc9adbd) into ci/integration-gcp-parity

Merge #673 (feat/gcp-embedded-sql-bigquery, 8d1e62f) into ci/integration-gcp-parity

Merge #674 (feat/gcp-governance-parity, 5422bec) into ci/integration-gcp-parity

integration: #673 on #676's undeclared BigQuery location, and #674's verify client answers #673's row count