From d45cbb39d76c4f9a82456a0cf37fffea7aab9ace Mon Sep 17 00:00:00 2001 From: Enrique Calderon Date: Fri, 3 Oct 2025 08:59:28 -0600 Subject: [PATCH 1/6] GCP User IAM workflow modified to post Terraform plan as a comment on PRs --- .../beam_Infrastructure_UsersPermissions.yml | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index 07f7c6fa2406..02f39a35590b 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -17,6 +17,8 @@ # This workflow modifies the GCP User Roles when the infra/users.yml file is updated. # It applies the changes using Terraform to manage the IAM roles for users defined in the users.yml +# If the workflow is triggered by a pull request, it will post the Terraform plan as a comment on the PR +# as a code block for easy review. name: Modify the GCP User Roles according to the infra/users.yml file @@ -28,6 +30,9 @@ on: - main paths: - 'infra/iam/users.yml' + pull_request: + paths: + - 'infra/iam/users.yml' # This allows a subsequently queued workflow run to interrupt previous runs concurrency: @@ -37,6 +42,7 @@ concurrency: #Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event permissions: contents: read + pull-requests: write jobs: beam_UserRoles: @@ -57,6 +63,28 @@ jobs: - name: Terraform Plan working-directory: ./infra/iam run: terraform plan -out=tfplan + + - name: Convert plan to plaintext + if: github.event_name == 'pull_request' + working-directory: ./infra/iam + run: terraform show -no-color tfplan > tfplan.txt + + - name: Create comment body + if: github.event_name == 'pull_request' + run: | + echo "### Terraform Plan for User Roles Changes" > comment_body.txt + echo '```' >> comment_body.txt + cat ./infra/iam/tfplan.txt >> comment_body.txt + echo '```' >> comment_body.txt + + - name: Upload plan as a comment to PR + if: github.event_name == 'pull_request' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_REPO: ${{ github.repository }} + run: gh pr comment ${{ github.event.pull_request.number }} --body-file comment_body.txt + - name: Terraform Apply + if: github.event_name == 'push' && github.ref == 'refs/heads/main' working-directory: ./infra/iam run: terraform apply -auto-approve tfplan From 5b92d0a0520ce0f49c889169832042ce96e544c7 Mon Sep 17 00:00:00 2001 From: Enrique Calderon Date: Tue, 7 Oct 2025 13:41:45 -0600 Subject: [PATCH 2/6] Update GCP IAM roles in users.yml and modify workflow permissions for pull requests --- .../beam_Infrastructure_UsersPermissions.yml | 9 ++++++--- infra/iam/users.yml | 13 ++++--------- 2 files changed, 10 insertions(+), 12 deletions(-) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index 02f39a35590b..cb2ee9e2b25c 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -30,7 +30,8 @@ on: - main paths: - 'infra/iam/users.yml' - pull_request: + pull_request_target: + types: [opened, synchronize, reopened] paths: - 'infra/iam/users.yml' @@ -41,7 +42,7 @@ concurrency: #Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event permissions: - contents: read + contents: write pull-requests: write jobs: @@ -51,6 +52,8 @@ jobs: timeout-minutes: 30 steps: - uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha }} - name: Setup gcloud uses: google-github-actions/setup-gcloud@v3 - name: Install Terraform @@ -85,6 +88,6 @@ jobs: run: gh pr comment ${{ github.event.pull_request.number }} --body-file comment_body.txt - name: Terraform Apply - if: github.event_name == 'push' && github.ref == 'refs/heads/main' + if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'apache/beam' working-directory: ./infra/iam run: terraform apply -auto-approve tfplan diff --git a/infra/iam/users.yml b/infra/iam/users.yml index 9bb5349e329a..9635af4b56e2 100644 --- a/infra/iam/users.yml +++ b/infra/iam/users.yml @@ -14,20 +14,12 @@ # limitations under the License. # IAM policy for project apache-beam-testing -# Generated on 2025-09-19 18:17:58 UTC +# Generated on 2025-10-07 16:00:39 UTC - username: WhatWouldAustinDo email: WhatWouldAustinDo@gmail.com permissions: - role: roles/editor -- username: a.khorbaladze - email: a.khorbaladze@akvelon.us - permissions: - - role: roles/bigquery.admin - - role: roles/container.admin - - role: roles/editor - - role: roles/iam.serviceAccountUser - - role: roles/secretmanager.admin - username: aaronleeiv email: aaronleeiv@google.com permissions: @@ -84,6 +76,7 @@ - role: roles/iam.serviceAccountTokenCreator - role: roles/iam.serviceAccountUser - role: roles/iam.workloadIdentityUser + - role: roles/storage.objectAdmin - role: roles/viewer - username: allows-impersonation-new email: allows-impersonation-new@apache-beam-testing.iam.gserviceaccount.com @@ -197,6 +190,7 @@ - role: roles/managedkafka.schemaRegistryEditor - role: roles/monitoring.metricWriter - role: roles/monitoring.viewer + - role: roles/secretmanager.admin - role: roles/spanner.databaseAdmin - role: roles/stackdriver.resourceMetadata.writer - role: roles/storage.admin @@ -238,6 +232,7 @@ - role: roles/iam.serviceAccountTokenCreator - role: roles/iam.serviceAccountUser - role: roles/pubsub.admin + - role: roles/secretmanager.admin - role: roles/spanner.admin - role: roles/storage.admin - role: roles/storage.folderAdmin From 0c51113f0aa857346a07df549c6f133ad4be3a67 Mon Sep 17 00:00:00 2001 From: Enrique Calderon Date: Tue, 7 Oct 2025 13:43:40 -0600 Subject: [PATCH 3/6] Update role for user to use custom beam_viewer role for testing --- infra/iam/users.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/iam/users.yml b/infra/iam/users.yml index 9635af4b56e2..da730810ec7f 100644 --- a/infra/iam/users.yml +++ b/infra/iam/users.yml @@ -367,7 +367,7 @@ - username: enriquecaol04 email: enriquecaol04@gmail.com permissions: - - role: roles/viewer + - role: projects/apache-beam-testing/roles/beam_viewer - username: eventarc-workflow-sa email: eventarc-workflow-sa@apache-beam-testing.iam.gserviceaccount.com permissions: From 5fc2471016847602065faa5ff47522de4350f95d Mon Sep 17 00:00:00 2001 From: P Date: Tue, 7 Oct 2025 13:36:18 -0700 Subject: [PATCH 4/6] Update beam_Infrastructure_UsersPermissions.yml Changing event_name to p_r_t, and removing the specific ref to checkout --- .../workflows/beam_Infrastructure_UsersPermissions.yml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index cb2ee9e2b25c..1a73045a4928 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -52,8 +52,6 @@ jobs: timeout-minutes: 30 steps: - uses: actions/checkout@v4 - with: - ref: ${{ github.event.pull_request.head.sha }} - name: Setup gcloud uses: google-github-actions/setup-gcloud@v3 - name: Install Terraform @@ -68,12 +66,12 @@ jobs: run: terraform plan -out=tfplan - name: Convert plan to plaintext - if: github.event_name == 'pull_request' + if: github.event_name == 'pull_request_target' working-directory: ./infra/iam run: terraform show -no-color tfplan > tfplan.txt - name: Create comment body - if: github.event_name == 'pull_request' + if: github.event_name == 'pull_request_target' run: | echo "### Terraform Plan for User Roles Changes" > comment_body.txt echo '```' >> comment_body.txt @@ -81,7 +79,7 @@ jobs: echo '```' >> comment_body.txt - name: Upload plan as a comment to PR - if: github.event_name == 'pull_request' + if: github.event_name == 'pull_request_target' env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} GH_REPO: ${{ github.repository }} From 2b7ef7855a2c2c0c5d4236a7ffdaefd5025bbcec Mon Sep 17 00:00:00 2001 From: P Date: Tue, 7 Oct 2025 13:38:03 -0700 Subject: [PATCH 5/6] Update beam_Infrastructure_UsersPermissions.yml removing all p_r_t filters to make it match all prs --- .github/workflows/beam_Infrastructure_UsersPermissions.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index 1a73045a4928..6106f257228b 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -31,9 +31,6 @@ on: paths: - 'infra/iam/users.yml' pull_request_target: - types: [opened, synchronize, reopened] - paths: - - 'infra/iam/users.yml' # This allows a subsequently queued workflow run to interrupt previous runs concurrency: From 535d1f988943fb65bf392846b689049f8fd50833 Mon Sep 17 00:00:00 2001 From: Enrique Calderon Date: Tue, 7 Oct 2025 14:51:15 -0600 Subject: [PATCH 6/6] Return the filer on pull_request_target beam_Infrastructure_UsersPermissions.yml --- .github/workflows/beam_Infrastructure_UsersPermissions.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index 6106f257228b..1a73045a4928 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -31,6 +31,9 @@ on: paths: - 'infra/iam/users.yml' pull_request_target: + types: [opened, synchronize, reopened] + paths: + - 'infra/iam/users.yml' # This allows a subsequently queued workflow run to interrupt previous runs concurrency: