Skip to content

Feature/add db and user - #11

Merged
skibinstein merged 2 commits into
mainfrom
feature/add-db-and-user
Feb 3, 2026
Merged

Feature/add db and user#11
skibinstein merged 2 commits into
mainfrom
feature/add-db-and-user

Conversation

@skibinstein

@skibinstein skibinstein commented Feb 3, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

github-actions[bot]
github-actions Bot reviewed Feb 3, 2026
View reviewed changes
Comment thread stacks/projects/kj-pola-backend-stg/cloud-run.tf

@github-actions github-actions Bot Feb 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 [Checkov] <CKV_TF_1> reported by reviewdog 🐶
Ensure Terraform module sources use a commit hash

pola-terraform/stacks/projects/kj-pola-backend-stg/cloud-run.tf

Lines 9 to 59 in 3326531

module "cloud_run" {
source = "github.com/GoogleCloudPlatform/cloud-foundation-fabric//modules/cloud-run-v2?ref=v51.0.0"
project_id = var.project_id
region = var.region
name = "${var.name.app}-${var.name.component}-${var.name.env}"
containers = {
app = {
image = var.cloud_run_image
volume_mounts = {
cloudsql = "/cloudsql"
}
resources = {
limits = {
cpu = var.cloud_run_cpu_limit
memory = var.cloud_run_memory_limit
}
}
}
}
volumes = {
cloudsql = {
cloud_sql_instances = [module.cloudsql.instance_connection_name]
}
}
service_account_config = {
name = local.cloud_run_service_account_name
roles = var.cloud_run_service_account_roles
}
# Terraform does the initial deployment only; CI/CD manages revisions after.
managed_revision = false
deletion_protection = false
service_config = {
ingress = "INGRESS_TRAFFIC_ALL"
invoker_iam_disabled = true
scaling = {
min_instance_count = var.cloud_run_min_instances
max_instance_count = var.cloud_run_max_instances
}
}
depends_on = [
module.vpc,
module.cloudsql
]
}

github-actions[bot]
github-actions Bot reviewed Feb 3, 2026
View reviewed changes
Comment thread stacks/projects/kj-pola-backend-stg/cloud-run.tf

@github-actions github-actions Bot Feb 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 [Checkov] <CKV_TF_1> reported by reviewdog 🐶
Ensure Terraform module sources use a commit hash

pola-terraform/stacks/projects/kj-pola-backend-stg/cloud-run.tf

Lines 9 to 59 in 3326531

module "cloud_run" {
source = "github.com/GoogleCloudPlatform/cloud-foundation-fabric//modules/cloud-run-v2?ref=v51.0.0"
project_id = var.project_id
region = var.region
name = "${var.name.app}-${var.name.component}-${var.name.env}"
containers = {
app = {
image = var.cloud_run_image
volume_mounts = {
cloudsql = "/cloudsql"
}
resources = {
limits = {
cpu = var.cloud_run_cpu_limit
memory = var.cloud_run_memory_limit
}
}
}
}
volumes = {
cloudsql = {
cloud_sql_instances = [module.cloudsql.instance_connection_name]
}
}
service_account_config = {
name = local.cloud_run_service_account_name
roles = var.cloud_run_service_account_roles
}
# Terraform does the initial deployment only; CI/CD manages revisions after.
managed_revision = false
deletion_protection = false
service_config = {
ingress = "INGRESS_TRAFFIC_ALL"
invoker_iam_disabled = true
scaling = {
min_instance_count = var.cloud_run_min_instances
max_instance_count = var.cloud_run_max_instances
}
}
depends_on = [
module.vpc,
module.cloudsql
]
}

github-actions[bot]
github-actions Bot reviewed Feb 3, 2026
View reviewed changes
Comment thread stacks/projects/kj-pola-backend-stg/cloudsql.tf

@github-actions github-actions Bot Feb 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 [Checkov] <CKV_TF_1> reported by reviewdog 🐶
Ensure Terraform module sources use a commit hash

pola-terraform/stacks/projects/kj-pola-backend-stg/cloudsql.tf

Lines 1 to 81 in 3326531

module "cloudsql" {
source = "terraform-google-modules/sql-db/google//modules/postgresql"
version = "~> 27.1"
project_id = var.project_id
region = var.region
name = "${var.name.app}-${var.name.component}-${var.name.env}-db"
database_version = var.cloudsql_database_version
tier = var.cloudsql_tier
deletion_protection = var.cloudsql_deletion_protection
disk_type = var.cloudsql_disk_type
disk_size = var.cloudsql_disk_size
disk_autoresize = var.cloudsql_disk_autoresize
disk_autoresize_limit = var.cloudsql_disk_autoresize_limit
database_flags = [
{
name = "autovacuum"
value = "on"
},
{
name = "cloudsql.iam_authentication"
value = "on"
},
{
name = "timezone"
value = "Europe/Warsaw"
}
]
insights_config = var.cloudsql_insights_enabled ? {
query_insights_enabled = true
query_string_length = 1024
record_application_tags = false
record_client_address = false
} : null
backup_configuration = var.cloudsql_backup_enabled ? {
enabled = true
start_time = var.cloudsql_backup_start_time
point_in_time_recovery_enabled = true
transaction_log_retention_days = 7
backup_retention_settings = {
retained_backups = var.cloudsql_backup_retained_backups
retention_unit = "COUNT"
}
} : null
ip_configuration = {
ipv4_enabled = false
private_network = module.vpc.network.self_link
enable_private_path_for_google_cloud_services = true
}
maintenance_window_day = var.cloudsql_maintenance_window_day
maintenance_window_hour = var.cloudsql_maintenance_window_hour
maintenance_window_update_track = var.cloudsql_maintenance_window_update_track
additional_databases = [
{
name = "pola"
charset = "UTF8"
collation = "en_US.UTF8"
}
]
iam_users = [
{
id = "pola"
email = "${var.name.app}-${var.name.component}-${var.name.env}@${var.project_id}.iam.gserviceaccount.com"
type = "CLOUD_IAM_SERVICE_ACCOUNT"
}
]
depends_on = [
module.vpc
]
}

github-actions[bot]
github-actions Bot reviewed Feb 3, 2026
View reviewed changes
Comment thread stacks/projects/kj-pola-backend-stg/cloudsql.tf

@github-actions github-actions Bot Feb 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 [Checkov] <CKV_TF_1> reported by reviewdog 🐶
Ensure Terraform module sources use a commit hash

pola-terraform/stacks/projects/kj-pola-backend-stg/cloudsql.tf

Lines 1 to 81 in 3326531

module "cloudsql" {
source = "terraform-google-modules/sql-db/google//modules/postgresql"
version = "~> 27.1"
project_id = var.project_id
region = var.region
name = "${var.name.app}-${var.name.component}-${var.name.env}-db"
database_version = var.cloudsql_database_version
tier = var.cloudsql_tier
deletion_protection = var.cloudsql_deletion_protection
disk_type = var.cloudsql_disk_type
disk_size = var.cloudsql_disk_size
disk_autoresize = var.cloudsql_disk_autoresize
disk_autoresize_limit = var.cloudsql_disk_autoresize_limit
database_flags = [
{
name = "autovacuum"
value = "on"
},
{
name = "cloudsql.iam_authentication"
value = "on"
},
{
name = "timezone"
value = "Europe/Warsaw"
}
]
insights_config = var.cloudsql_insights_enabled ? {
query_insights_enabled = true
query_string_length = 1024
record_application_tags = false
record_client_address = false
} : null
backup_configuration = var.cloudsql_backup_enabled ? {
enabled = true
start_time = var.cloudsql_backup_start_time
point_in_time_recovery_enabled = true
transaction_log_retention_days = 7
backup_retention_settings = {
retained_backups = var.cloudsql_backup_retained_backups
retention_unit = "COUNT"
}
} : null
ip_configuration = {
ipv4_enabled = false
private_network = module.vpc.network.self_link
enable_private_path_for_google_cloud_services = true
}
maintenance_window_day = var.cloudsql_maintenance_window_day
maintenance_window_hour = var.cloudsql_maintenance_window_hour
maintenance_window_update_track = var.cloudsql_maintenance_window_update_track
additional_databases = [
{
name = "pola"
charset = "UTF8"
collation = "en_US.UTF8"
}
]
iam_users = [
{
id = "pola"
email = "${var.name.app}-${var.name.component}-${var.name.env}@${var.project_id}.iam.gserviceaccount.com"
type = "CLOUD_IAM_SERVICE_ACCOUNT"
}
]
depends_on = [
module.vpc
]
}

@github-actions

github-actions Bot commented Feb 3, 2026

Copy link
Copy Markdown

Project: kj-pola-web-stg

Terraform Format and Style 🖌 ✅

Checkov Security Scan 🔒 ❌

Terraform Initialization ⚙️ ✅

Terraform Validation 🤖 ✅

Terraform Plan 📖 ✅

Show Plan 
terraform
module.gh_oidc.google_iam_workload_identity_pool.main: Refreshing state... [id=projects/kj-pola-web-stg/locations/global/workloadIdentityPools/github-actions-pool]
module.project_services.google_project_service.project_services["iam.googleapis.com"]: Refreshing state... [id=kj-pola-web-stg/iam.googleapis.com]
module.project_services.google_project_service.project_services["cloudresourcemanager.googleapis.com"]: Refreshing state... [id=kj-pola-web-stg/cloudresourcemanager.googleapis.com]
module.service_account.google_service_account.service_accounts["terraform-runner"]: Refreshing state... [id=projects/kj-pola-web-stg/serviceAccounts/terraform-runner@kj-pola-web-stg.iam.gserviceaccount.com]
module.project_services.google_project_service.project_services["storage.googleapis.com"]: Refreshing state... [id=kj-pola-web-stg/storage.googleapis.com]
module.project_services.google_project_service.project_services["serviceusage.googleapis.com"]: Refreshing state... [id=kj-pola-web-stg/serviceusage.googleapis.com]
module.project_services.google_project_service.project_services["monitoring.googleapis.com"]: Refreshing state... [id=kj-pola-web-stg/monitoring.googleapis.com]
module.project_services.google_project_service.project_services["logging.googleapis.com"]: Refreshing state... [id=kj-pola-web-stg/logging.googleapis.com]
module.gh_oidc.google_iam_workload_identity_pool_provider.main: Refreshing state... [id=projects/kj-pola-web-stg/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-stg=>roles/storage.objectAdmin"]: Refreshing state... [id=kj-pola-web-stg/roles/storage.objectAdmin/serviceAccount:terraform-runner@kj-pola-web-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-stg=>roles/serviceusage.serviceUsageAdmin"]: Refreshing state... [id=kj-pola-web-stg/roles/serviceusage.serviceUsageAdmin/serviceAccount:terraform-runner@kj-pola-web-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-stg=>roles/viewer"]: Refreshing state... [id=kj-pola-web-stg/roles/viewer/serviceAccount:terraform-runner@kj-pola-web-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-stg=>roles/iam.serviceAccountUser"]: Refreshing state... [id=kj-pola-web-stg/roles/iam.serviceAccountUser/serviceAccount:terraform-runner@kj-pola-web-stg.iam.gserviceaccount.com]
module.gh_oidc.google_service_account_iam_member.wif-sa["terraform-runner"]: Refreshing state... [id=projects/kj-pola-web-stg/serviceAccounts/terraform-runner@kj-pola-web-stg.iam.gserviceaccount.com/roles/iam.workloadIdentityUser/principalSet://iam.googleapis.com/projects/345026739965/locations/global/workloadIdentityPools/github-actions-pool/attribute.repository/KlubJagiellonski/pola-terraform]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

Pusher: @skibinstein, Action: pull_request, Working Directory: stacks/projects/kj-pola-web-stg, Workflow: Terraform

@github-actions

github-actions Bot commented Feb 3, 2026

Copy link
Copy Markdown

Project: kj-pola-shared-prod

Terraform Format and Style 🖌 ✅

Checkov Security Scan 🔒 ❌

Terraform Initialization ⚙️ ✅

Terraform Validation 🤖 ✅

Terraform Plan 📖 ✅

Show Plan 
terraform
module.project_services.google_project_service.project_services["artifactregistry.googleapis.com"]: Refreshing state... [id=kj-pola-shared-prod/artifactregistry.googleapis.com]
module.project_services.google_project_service.project_services["logging.googleapis.com"]: Refreshing state... [id=kj-pola-shared-prod/logging.googleapis.com]
module.project_services.google_project_service.project_services["cloudresourcemanager.googleapis.com"]: Refreshing state... [id=kj-pola-shared-prod/cloudresourcemanager.googleapis.com]
module.project_services.google_project_service.project_services["monitoring.googleapis.com"]: Refreshing state... [id=kj-pola-shared-prod/monitoring.googleapis.com]
module.project_services.google_project_service.project_services["iam.googleapis.com"]: Refreshing state... [id=kj-pola-shared-prod/iam.googleapis.com]
module.service_account.google_service_account.service_accounts["terraform-runner"]: Refreshing state... [id=projects/kj-pola-shared-prod/serviceAccounts/terraform-runner@kj-pola-shared-prod.iam.gserviceaccount.com]
module.project_services.google_project_service.project_services["serviceusage.googleapis.com"]: Refreshing state... [id=kj-pola-shared-prod/serviceusage.googleapis.com]
module.project_services.google_project_service.project_services["storage.googleapis.com"]: Refreshing state... [id=kj-pola-shared-prod/storage.googleapis.com]
module.docker_registry.google_artifact_registry_repository.repo: Refreshing state... [id=projects/kj-pola-shared-prod/locations/europe-central2/repositories/pola]
module.gh_oidc.google_iam_workload_identity_pool.main: Refreshing state... [id=projects/kj-pola-shared-prod/locations/global/workloadIdentityPools/github-actions-pool]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-shared-prod=>roles/artifactregistry.admin"]: Refreshing state... [id=kj-pola-shared-prod/roles/artifactregistry.admin/serviceAccount:terraform-runner@kj-pola-shared-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-shared-prod=>roles/iam.serviceAccountUser"]: Refreshing state... [id=kj-pola-shared-prod/roles/iam.serviceAccountUser/serviceAccount:terraform-runner@kj-pola-shared-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-shared-prod=>roles/serviceusage.serviceUsageAdmin"]: Refreshing state... [id=kj-pola-shared-prod/roles/serviceusage.serviceUsageAdmin/serviceAccount:terraform-runner@kj-pola-shared-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-shared-prod=>roles/viewer"]: Refreshing state... [id=kj-pola-shared-prod/roles/viewer/serviceAccount:terraform-runner@kj-pola-shared-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-shared-prod=>roles/storage.objectAdmin"]: Refreshing state... [id=kj-pola-shared-prod/roles/storage.objectAdmin/serviceAccount:terraform-runner@kj-pola-shared-prod.iam.gserviceaccount.com]
module.gh_oidc.google_iam_workload_identity_pool_provider.main: Refreshing state... [id=projects/kj-pola-shared-prod/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider]
module.gh_oidc.google_service_account_iam_member.wif-sa["terraform-runner"]: Refreshing state... [id=projects/kj-pola-shared-prod/serviceAccounts/terraform-runner@kj-pola-shared-prod.iam.gserviceaccount.com/roles/iam.workloadIdentityUser/principalSet://iam.googleapis.com/projects/802307596796/locations/global/workloadIdentityPools/github-actions-pool/attribute.repository/KlubJagiellonski/pola-terraform]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

Pusher: @skibinstein, Action: pull_request, Working Directory: stacks/projects/kj-pola-shared-prod, Workflow: Terraform

@github-actions

github-actions Bot commented Feb 3, 2026

Copy link
Copy Markdown

Project: kj-pola-web-prod

Terraform Format and Style 🖌 ✅

Checkov Security Scan 🔒 ❌

Terraform Initialization ⚙️ ✅

Terraform Validation 🤖 ✅

Terraform Plan 📖 ✅

Show Plan 
terraform
Acquiring state lock. This may take a few moments...
module.project_services.google_project_service.project_services["cloudresourcemanager.googleapis.com"]: Refreshing state... [id=kj-pola-web-prod/cloudresourcemanager.googleapis.com]
module.project_services.google_project_service.project_services["monitoring.googleapis.com"]: Refreshing state... [id=kj-pola-web-prod/monitoring.googleapis.com]
module.project_services.google_project_service.project_services["serviceusage.googleapis.com"]: Refreshing state... [id=kj-pola-web-prod/serviceusage.googleapis.com]
module.project_services.google_project_service.project_services["storage.googleapis.com"]: Refreshing state... [id=kj-pola-web-prod/storage.googleapis.com]
module.project_services.google_project_service.project_services["logging.googleapis.com"]: Refreshing state... [id=kj-pola-web-prod/logging.googleapis.com]
module.project_services.google_project_service.project_services["iam.googleapis.com"]: Refreshing state... [id=kj-pola-web-prod/iam.googleapis.com]
module.service_account.google_service_account.service_accounts["terraform-runner"]: Refreshing state... [id=projects/kj-pola-web-prod/serviceAccounts/terraform-runner@kj-pola-web-prod.iam.gserviceaccount.com]
module.gh_oidc.google_iam_workload_identity_pool.main: Refreshing state... [id=projects/kj-pola-web-prod/locations/global/workloadIdentityPools/github-actions-pool]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-prod=>roles/serviceusage.serviceUsageAdmin"]: Refreshing state... [id=kj-pola-web-prod/roles/serviceusage.serviceUsageAdmin/serviceAccount:terraform-runner@kj-pola-web-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-prod=>roles/storage.objectAdmin"]: Refreshing state... [id=kj-pola-web-prod/roles/storage.objectAdmin/serviceAccount:terraform-runner@kj-pola-web-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-prod=>roles/viewer"]: Refreshing state... [id=kj-pola-web-prod/roles/viewer/serviceAccount:terraform-runner@kj-pola-web-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-prod=>roles/iam.serviceAccountUser"]: Refreshing state... [id=kj-pola-web-prod/roles/iam.serviceAccountUser/serviceAccount:terraform-runner@kj-pola-web-prod.iam.gserviceaccount.com]
module.gh_oidc.google_iam_workload_identity_pool_provider.main: Refreshing state... [id=projects/kj-pola-web-prod/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider]
module.gh_oidc.google_service_account_iam_member.wif-sa["terraform-runner"]: Refreshing state... [id=projects/kj-pola-web-prod/serviceAccounts/terraform-runner@kj-pola-web-prod.iam.gserviceaccount.com/roles/iam.workloadIdentityUser/principalSet://iam.googleapis.com/projects/288124577198/locations/global/workloadIdentityPools/github-actions-pool/attribute.repository/KlubJagiellonski/pola-terraform]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.
Releasing state lock. This may take a few moments...

Pusher: @skibinstein, Action: pull_request, Working Directory: stacks/projects/kj-pola-web-prod, Workflow: Terraform

@github-actions

github-actions Bot commented Feb 3, 2026

Copy link
Copy Markdown

Project: kj-pola-backend-prod

Terraform Format and Style 🖌 ✅

Checkov Security Scan 🔒 ❌

Terraform Initialization ⚙️ ✅

Terraform Validation 🤖 ✅

Terraform Plan 📖 ✅

Show Plan 
terraform
module.gh_oidc.google_iam_workload_identity_pool.main: Refreshing state... [id=projects/kj-pola-backend-prod/locations/global/workloadIdentityPools/github-actions-pool]
module.project_services.google_project_service.project_services["logging.googleapis.com"]: Refreshing state... [id=kj-pola-backend-prod/logging.googleapis.com]
module.project_services.google_project_service.project_services["storage.googleapis.com"]: Refreshing state... [id=kj-pola-backend-prod/storage.googleapis.com]
module.project_services.google_project_service.project_services["monitoring.googleapis.com"]: Refreshing state... [id=kj-pola-backend-prod/monitoring.googleapis.com]
module.project_services.google_project_service.project_services["iam.googleapis.com"]: Refreshing state... [id=kj-pola-backend-prod/iam.googleapis.com]
module.project_services.google_project_service.project_services["serviceusage.googleapis.com"]: Refreshing state... [id=kj-pola-backend-prod/serviceusage.googleapis.com]
module.service_account.google_service_account.service_accounts["terraform-runner"]: Refreshing state... [id=projects/kj-pola-backend-prod/serviceAccounts/terraform-runner@kj-pola-backend-prod.iam.gserviceaccount.com]
module.project_services.google_project_service.project_services["cloudresourcemanager.googleapis.com"]: Refreshing state... [id=kj-pola-backend-prod/cloudresourcemanager.googleapis.com]
module.gh_oidc.google_iam_workload_identity_pool_provider.main: Refreshing state... [id=projects/kj-pola-backend-prod/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-prod=>roles/iam.serviceAccountUser"]: Refreshing state... [id=kj-pola-backend-prod/roles/iam.serviceAccountUser/serviceAccount:terraform-runner@kj-pola-backend-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-prod=>roles/viewer"]: Refreshing state... [id=kj-pola-backend-prod/roles/viewer/serviceAccount:terraform-runner@kj-pola-backend-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-prod=>roles/storage.objectAdmin"]: Refreshing state... [id=kj-pola-backend-prod/roles/storage.objectAdmin/serviceAccount:terraform-runner@kj-pola-backend-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-prod=>roles/serviceusage.serviceUsageAdmin"]: Refreshing state... [id=kj-pola-backend-prod/roles/serviceusage.serviceUsageAdmin/serviceAccount:terraform-runner@kj-pola-backend-prod.iam.gserviceaccount.com]
module.gh_oidc.google_service_account_iam_member.wif-sa["terraform-runner"]: Refreshing state... [id=projects/kj-pola-backend-prod/serviceAccounts/terraform-runner@kj-pola-backend-prod.iam.gserviceaccount.com/roles/iam.workloadIdentityUser/principalSet://iam.googleapis.com/projects/306379713727/locations/global/workloadIdentityPools/github-actions-pool/attribute.repository/KlubJagiellonski/pola-terraform]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

Pusher: @skibinstein, Action: pull_request, Working Directory: stacks/projects/kj-pola-backend-prod, Workflow: Terraform

@github-actions

github-actions Bot commented Feb 3, 2026

Copy link
Copy Markdown

Project: kj-pola-backend-stg

Terraform Format and Style 🖌 ❌

Checkov Security Scan 🔒 ❌

Terraform Initialization ⚙️ ✅

Terraform Validation 🤖 ✅

Terraform Plan 📖 ❌

Show Plan 
terraform
Acquiring state lock. This may take a few moments...
data.google_project.current: Reading...
module.project_services.google_project_service.project_services["iam.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/iam.googleapis.com]
module.project_services.google_project_service.project_services["run.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/run.googleapis.com]
module.project_services.google_project_service.project_services["serviceusage.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/serviceusage.googleapis.com]
module.vpc.google_compute_network.network[0]: Refreshing state... [id=projects/kj-pola-backend-stg/global/networks/pola-backend-stg-vpc]
module.project_services.google_project_service.project_services["monitoring.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/monitoring.googleapis.com]
module.project_services.google_project_service.project_services["logging.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/logging.googleapis.com]
module.project_services.google_project_service.project_services["cloudresourcemanager.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/cloudresourcemanager.googleapis.com]
module.service_account.google_service_account.service_accounts["terraform-runner"]: Refreshing state... [id=projects/kj-pola-backend-stg/serviceAccounts/terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.project_services.google_project_service.project_services["sqladmin.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/sqladmin.googleapis.com]
module.project_services.google_project_service.project_services["servicenetworking.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/servicenetworking.googleapis.com]
data.google_project.current: Read complete after 0s [id=projects/kj-pola-backend-stg]
module.project_services.google_project_service.project_services["storage.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/storage.googleapis.com]
module.project_services.google_project_service.project_services["compute.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/compute.googleapis.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/serviceusage.serviceUsageAdmin"]: Refreshing state... [id=kj-pola-backend-stg/roles/serviceusage.serviceUsageAdmin/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/iam.serviceAccountUser"]: Refreshing state... [id=kj-pola-backend-stg/roles/iam.serviceAccountUser/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/servicenetworking.networksAdmin"]: Refreshing state... [id=kj-pola-backend-stg/roles/servicenetworking.networksAdmin/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/compute.networkAdmin"]: Refreshing state... [id=kj-pola-backend-stg/roles/compute.networkAdmin/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/viewer"]: Refreshing state... [id=kj-pola-backend-stg/roles/viewer/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/cloudsql.admin"]: Refreshing state... [id=kj-pola-backend-stg/roles/cloudsql.admin/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/artifactregistry.reader"]: Refreshing state... [id=kj-pola-backend-stg/roles/artifactregistry.reader/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/storage.objectAdmin"]: Refreshing state... [id=kj-pola-backend-stg/roles/storage.objectAdmin/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/run.admin"]: Refreshing state... [id=kj-pola-backend-stg/roles/run.admin/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.gh_oidc.google_iam_workload_identity_pool.main: Refreshing state... [id=projects/kj-pola-backend-stg/locations/global/workloadIdentityPools/github-actions-pool]
module.vpc.google_compute_global_address.psa_ranges["servicenetworking-googleapis-com-pola-backend-stg-psa-range"]: Refreshing state... [id=projects/kj-pola-backend-stg/global/addresses/servicenetworking-googleapis-com-pola-backend-stg-psa-range]
module.vpc.google_compute_route.gateway["private-googleapis"]: Refreshing state... [id=projects/kj-pola-backend-stg/global/routes/pola-backend-stg-vpc-private-googleapis]
module.vpc.google_compute_route.gateway["restricted-googleapis"]: Refreshing state... [id=projects/kj-pola-backend-stg/global/routes/pola-backend-stg-vpc-restricted-googleapis]
module.vpc.google_compute_route.gateway["directpath-googleapis"]: Refreshing state... [id=projects/kj-pola-backend-stg/global/routes/pola-backend-stg-vpc-directpath-googleapis]
module.gh_oidc.google_service_account_iam_member.wif-sa["terraform-runner"]: Refreshing state... [id=projects/kj-pola-backend-stg/serviceAccounts/terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com/roles/iam.workloadIdentityUser/principalSet://iam.googleapis.com/projects/901165314592/locations/global/workloadIdentityPools/github-actions-pool/attribute.repository/KlubJagiellonski/pola-terraform]
module.vpc.google_service_networking_connection.psa_connection["servicenetworking.googleapis.com"]: Refreshing state... [id=projects%2Fkj-pola-backend-stg%2Fglobal%2Fnetworks%2Fpola-backend-stg-vpc:servicenetworking.googleapis.com]
module.gh_oidc.google_iam_workload_identity_pool_provider.main: Refreshing state... [id=projects/kj-pola-backend-stg/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider]
google_project_iam_member.cloud_run_service_agent_artifact_registry_reader: Refreshing state... [id=kj-pola-shared-prod/roles/artifactregistry.reader/serviceAccount:service-901165314592@serverless-robot-prod.iam.gserviceaccount.com]
module.vpc.google_compute_subnetwork.subnetwork["europe-central2/pola-backend-stg-subnet"]: Refreshing state... [id=projects/kj-pola-backend-stg/regions/europe-central2/subnetworks/pola-backend-stg-subnet]
module.vpc.google_compute_network_peering_routes_config.psa_routes["servicenetworking.googleapis.com"]: Refreshing state... [id=projects/kj-pola-backend-stg/global/networks/pola-backend-stg-vpc/networkPeerings/servicenetworking-googleapis-com]
module.cloudsql.data.google_compute_zones.available: Reading...
module.cloudsql.null_resource.module_depends_on: Refreshing state... [id=4401079993938560727]
module.cloudsql.google_sql_database_instance.default: Refreshing state... [id=pola-backend-stg-db]
module.cloudsql.data.google_compute_zones.available: Read complete after 0s [id=projects/kj-pola-backend-stg/regions/europe-central2]
module.cloudsql.google_sql_user.iam_account["pola"]: Refreshing state... [id=pola-backend-stg@kj-pola-backend-stg.iam//pola-backend-stg-db]
module.cloudsql.random_password.user-password[0]: Refreshing state... [id=none]
module.cloudsql.google_sql_database.default[0]: Refreshing state... [id=projects/kj-pola-backend-stg/instances/pola-backend-stg-db/databases/default]
module.cloudsql.google_sql_user.default[0]: Refreshing state... [id=default//pola-backend-stg-db]
module.cloud_run.google_service_account.service_account[0]: Refreshing state... [id=projects/kj-pola-backend-stg/serviceAccounts/pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com]
module.cloud_run.google_project_iam_member.default["roles/monitoring.metricWriter"]: Refreshing state... [id=kj-pola-backend-stg/roles/monitoring.metricWriter/serviceAccount:pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com]
module.cloud_run.google_project_iam_member.default["roles/cloudsql.client"]: Refreshing state... [id=kj-pola-backend-stg/roles/cloudsql.client/serviceAccount:pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com]
module.cloud_run.google_project_iam_member.default["roles/storage.objectAdmin"]: Refreshing state... [id=kj-pola-backend-stg/roles/storage.objectAdmin/serviceAccount:pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com]
module.cloud_run.google_project_iam_member.default["roles/logging.logWriter"]: Refreshing state... [id=kj-pola-backend-stg/roles/logging.logWriter/serviceAccount:pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com]
module.cloud_run.google_project_iam_member.default["roles/artifactregistry.reader"]: Refreshing state... [id=kj-pola-backend-stg/roles/artifactregistry.reader/serviceAccount:pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com]
module.cloud_run.google_cloud_run_v2_service.service_unmanaged[0]: Refreshing state... [id=projects/kj-pola-backend-stg/locations/europe-central2/services/pola-backend-stg]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.cloudsql.google_sql_database_instance.default has changed
  ~ resource "google_sql_database_instance" "default" {
        id                             = "pola-backend-stg-db"
        name                           = "pola-backend-stg-db"
        # (22 unchanged attributes hidden)

      ~ settings {
          ~ version                          = 5 -> 15
            # (20 unchanged attributes hidden)

            # (10 unchanged blocks hidden)
        }

        # (2 unchanged blocks hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform planned the following actions, but then encountered a problem:

  # module.cloudsql.google_sql_database.additional_databases["pola"] will be created
  + resource "google_sql_database" "additional_databases" {
      + charset         = "UTF8"
      + collation       = "en_US.UTF8"
      + deletion_policy = "DELETE"
      + id              = (known after apply)
      + instance        = "pola-backend-stg-db"
      + name            = "pola"
      + project         = "kj-pola-backend-stg"
      + self_link       = (known after apply)
    }

  # module.cloudsql.google_sql_database_instance.default will be updated in-place
  ~ resource "google_sql_database_instance" "default" {
      ~ deletion_protection            = false -> true
        id                             = "pola-backend-stg-db"
        name                           = "pola-backend-stg-db"
        # (21 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

Plan: 1 to add, 1 to change, 0 to destroy.
Releasing state lock. This may take a few moments...

Pusher: @skibinstein, Action: pull_request, Working Directory: stacks/projects/kj-pola-backend-stg, Workflow: Terraform

@skibinstein
skibinstein merged commit cb767d9 into main Feb 3, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@skibinstein