Cutover runbook: make the API public with --no-invoker-iam-check - #267
Conversation
Pre-flight P1 showed the project's org policy rejects an allUsers binding: --allow-unauthenticated left the test service private (403), while --no-invoker-iam-check served it publicly (200). Step 2 now uses that flag and checks the health endpoint answers 200 without credentials; P1 records the result and how to re-check it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
v1 points at fa565e1, an untagged sync made after v1.1.2, so the release is v1.2.0 and rollback moves v1 back to fa565e1; rolling back to v1.1.2 would also have undone the sync. Also ticks P2, P3 and P6 (P6 is devasignhq/verify-action#3, unmerged until step 5). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Added |
There was a problem hiding this comment.
DevAsign Code Review
No issues found
✅ Merge score: 100/100
8 of 8 acceptance criteria met.
All eight criteria are satisfied by the documentation changes in backend/deploy/gcp/CUTOVER.md.
Tests: 3 passed, 0 unverifiable — see the "Tests by DevAsign" comment.
Tests by DevAsign✅ 3 of 3 criteria verified by tests. Each verdict below links to its evidence. 6 — In CUTOVER.md P6, the verify-action change is marked done and references devasignhq/verify-action#3, states to leave it unmerged until step 5, and notes that v1 currently points at fa565e1 (an untagged sync), not v1.1.2. (pass)Verdict: pass All four assertions confirm P6 is marked done, references verify-action#3, states to leave it unmerged until step 5, and notes v1 points at fa565e1 not v1.1.2. Test: 7 — In CUTOVER.md step 5, the release is tagged v1.2.0 (not v1.1.3) and v1 is force-moved to v1.2.0. (pass)Verdict: pass Assertions confirm step 5 tags the release v1.2.0, avoids v1.1.3, and force-moves v1 to v1.2.0. Test: 8 — In CUTOVER.md rollback (before step 6), verify-action v1 is moved back to fa565e1 (not v1.1.2) via `git tag -f v1 fa565e1 && git push -f origin v1`, with a note that rolling back to v1.1.2 would undo the sync. (pass)Verdict: pass Assertion confirms the rollback before step 6 moves verify-action v1 back to fa565e1, not v1.1.2. Test: |
Records the result of pre-flight check P1 in
backend/deploy/gcp/CUTOVER.mdand updates step 2 to match.What P1 found (2026-09-24, throwaway
public-checkservice running Google's hello container inus-east4)--allow-unauthenticated: the revision deployed, but "Setting IAM policy failed". The org policy rejects theallUsersbinding, and the service stayed private (unauthenticated403).gcloud run services update --no-invoker-iam-check: succeeded, and unauthenticated requests got200(checked repeatedly). The annotationrun.googleapis.com/invoker-iam-disabledreadtrue.404.Changes
run.managed.requireInvokerIamever refuses the flag.--no-invoker-iam-checkinstead of--allow-unauthenticated, notes that the API does its own auth (session cookies, webhook signatures, OIDC for verify), and adds a check that$API/api/healthreturns200without credentials.Documentation only; the
devasign-api-maintrigger ignoresbackend/deploy/**.🤖 Generated with Claude Code