Wire module expander into CI, remove old generator#21
Merged
Alexanderamiri merged 1 commit intomainfrom Mar 9, 2026
Merged
Conversation
- New expand-terraform.yml workflow: runs once, commits expanded TF files - tf-plan and tf-apply no longer expand — they use committed .tf files - Removed generate-terraform.sh (replaced by expand-modules.py) - Removed terraform/modules/app-stack/ (replaced by registry-driven expander) - Updated javabin.yml: expand runs before tf-plan, commit-terraform removed
Terraform PlanNo changes — infrastructure is up to date. Plan output |
3 tasks
Alexanderamiri
added a commit
that referenced
this pull request
Apr 14, 2026
## Summary - When the team-provisioner creates or syncs hero accounts, it now sets up Gmail auto-forwarding so all mail to the java.no address is forwarded to the member's personal email (copy kept in inbox) - Uses domain-wide delegation to impersonate each user via the Gmail Settings API — forwarding addresses are accepted without verification - Applies to both new and existing accounts (idempotent — skips already-configured forwarding) ## Changes - Added `gmail.settings.sharing` scope to `GOOGLE_SCOPES` - New `_get_user_google_access_token()` — mints per-user JWT tokens (cached) - New `_setup_email_forwarding()` — registers forwarding address + enables auto-forwarding - Called after account creation in `handle_sync_groups_and_heros` for both new and existing accounts ## Prerequisites - `gmail.settings.sharing` scope added to domain-wide delegation in Google Admin console ✅ ## Test plan - [ ] Deploy Lambda, then merge registry PR #21 (members sync) - [ ] Verify forwarding is active on a newly created java.no account - [ ] Verify forwarding is set up for an existing account (e.g. alexander.amiri@java.no)
Alexanderamiri
added a commit
that referenced
this pull request
Apr 14, 2026
## Summary - Increases team-provisioner Lambda timeout from 60s to 300s - With 54 members, the Lambda timed out during group sync after creating all accounts - Each member takes ~3s (check exists + create + forwarding attempt + welcome email), so 54 members alone need ~162s before group sync even starts ## Context The provision-groups run from registry PR #21 merge timed out at 60s. All accounts were created and welcome emails sent, but group membership sync didn't complete.
Alexanderamiri
added a commit
that referenced
this pull request
May 9, 2026
## Summary - New `expand-terraform.yml` workflow runs once before tf-plan, commits expanded .tf files - tf-plan and tf-apply use committed files — no repeated expansion - Removed `generate-terraform.sh` and `terraform/modules/app-stack/` — replaced by `expand-modules.py` + `registry.py` - No pip dependencies — uses `yq` (pre-installed) for YAML parsing ## Flow ``` expand → tf-plan → plan-review → tf-apply → docker-build → ecs-deploy ``` ## Test plan - [ ] CI passes on this PR - [ ] Delete test app state, trigger fresh CI run - [ ] Verify expanded .tf files are committed to test app repo - [ ] Verify plan and apply work on committed files
Alexanderamiri
added a commit
that referenced
this pull request
May 9, 2026
## Summary - When the team-provisioner creates or syncs hero accounts, it now sets up Gmail auto-forwarding so all mail to the java.no address is forwarded to the member's personal email (copy kept in inbox) - Uses domain-wide delegation to impersonate each user via the Gmail Settings API — forwarding addresses are accepted without verification - Applies to both new and existing accounts (idempotent — skips already-configured forwarding) ## Changes - Added `gmail.settings.sharing` scope to `GOOGLE_SCOPES` - New `_get_user_google_access_token()` — mints per-user JWT tokens (cached) - New `_setup_email_forwarding()` — registers forwarding address + enables auto-forwarding - Called after account creation in `handle_sync_groups_and_heros` for both new and existing accounts ## Prerequisites - `gmail.settings.sharing` scope added to domain-wide delegation in Google Admin console ✅ ## Test plan - [ ] Deploy Lambda, then merge registry PR #21 (members sync) - [ ] Verify forwarding is active on a newly created java.no account - [ ] Verify forwarding is set up for an existing account (e.g. alexander.amiri@java.no)
Alexanderamiri
added a commit
that referenced
this pull request
May 9, 2026
## Summary - Increases team-provisioner Lambda timeout from 60s to 300s - With 54 members, the Lambda timed out during group sync after creating all accounts - Each member takes ~3s (check exists + create + forwarding attempt + welcome email), so 54 members alone need ~162s before group sync even starts ## Context The provision-groups run from registry PR #21 merge timed out at 60s. All accounts were created and welcome emails sent, but group membership sync didn't complete.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
expand-terraform.ymlworkflow runs once before tf-plan, commits expanded .tf filesgenerate-terraform.shandterraform/modules/app-stack/— replaced byexpand-modules.py+registry.pyyq(pre-installed) for YAML parsingFlow
Test plan