ac-tools-gcp-setup

GCP Setup — Cloud Build + Cloud Run

Interactive skill for bootstrapping GCP infrastructure for Cloud Build + Cloud Run projects. Handles everything from gcloud auth login to verified production deploy.

Security First

Every phase validates security posture. The skill enforces:

• Dedicated runtime service account (never default compute SA)
• Per-secret IAM bindings (never project-level secretAccessor)
• Approval-gated Cloud Build triggers
• Non-root container execution
• Optional app-level OAuth with configurable domain restriction
• Same-origin CORS in production
• Secrets in Secret Manager only (never env vars, never in images)

Tool Paths

All tools are relative to this skill directory:

SKILL_DIR="."

Workflow

Phase 0: Config Detection

Detect and load configuration before any infrastructure operations.

0a: User-Level Customization (BLOCKING)

Check ~/.agents/customization/gcp-setup/index.md for saved preferences.

If missing, use AskUserQuestion to collect:

• Company domain (e.g., example.com)
• Company name (e.g., Example Corp)
• GitHub organization (e.g., ExampleOrg)
• Preferred GCP region (e.g., us-central1)

Save to ~/.agents/customization/gcp-setup/index.md:

# GCP Setup Preferences

- domain: example.com
- company: Example Corp
- github_org: ExampleOrg
- region: us-central1

If values already exist, present them as defaults. If user provides different values, update index.md.

0b: Project-Level Config (BLOCKING)

Detect .gcp-setup.yml in the project root.

If exists: Load and present current config to user. AskUserQuestion: "Config found. Proceed with these settings, or modify?"

If missing: Auto-detect everything possible, then confirm. Typeform-style: one question at a time, smart defaults, minimal friction.

Step 1: Silent auto-detection (no user interaction — run all probes first)

# GitHub repo from git remote
GITHUB_REMOTE=$(git remote get-url origin || true)
GITHUB_SLUG=$(printf "%s\n" "$GITHUB_REMOTE" | sed -E 's#.*[:/]([^/]+/[^/.]+)(\.git)?$#\1#')
DIR_NAME=$(basename "$(pwd)")

# Runtime + framework
RUNTIME=""
[[ -f package.json ]] && RUNTIME="nodejs"
[[ -f requirements.txt || -f pyproject.toml ]] && RUNTIME="python"
[[ -f go.mod ]] && RUNTIME="go"
FRAMEWORK=""
[[ -f package.json ]] && grep -q '"express"' package.json && FRAMEWORK="express"
for file in requirements.txt pyproject.toml; do
  [[ -f "$file" ]] && grep -q 'fastapi' "$file" && FRAMEWORK="fastapi"
done

# Feature detection from code/dependencies
HAS_OAUTH=$(grep -rl -m 1 "passport\|GoogleStrategy\|google-auth-library\|authlib" \
  --include="*.ts" --include="*.js" --include="*.py" \
  --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=vendor . | head -1)
HAS_FIRESTORE=$(grep -rl -m 1 "@google-cloud/firestore\|google.cloud.firestore" \
  --include="*.ts" --include="*.js" --include="*.py" --include="*.go" \
  --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=vendor . | head -1)

# Build configs, Dockerfile, health endpoint
CLOUDBUILD_FILES=$(compgen -G "cloudbuild*.yaml"; compgen -G "cloudbuild*.yml")
DOCKERFILE=$(find . -maxdepth 2 -name Dockerfile -print | head -1)
HEALTH_EP=$(grep -roh '"/health[z]*"\|"/api/health"' \
  --include="*.ts" --include="*.js" --include="*.py" . | head -1 | tr -d '"')

# Secret manifest from .env.example
ENV_EXAMPLE=""
for candidate in .env.example .env.sample env.example; do
  [[ -f "$candidate" ]] && ENV_EXAMPLE="$candidate" && break
done

# GCP projects (for matching)
if GCLOUD_BIN=$(command -v gcloud); then
  GCP_PROJECTS=$("$GCLOUD_BIN" projects list --format="value(projectId)")
else
  GCP_PROJECTS=""
fi