Execution: enable staging auto-rebuild (codeq push → build-lab-base, scoped IAM)

[Kenny-Heitritter]

Parent

Map #16 · implements the Phase 1 decision locked in #19 (staging auto-rebuild).

What to build

Close the HOP-2 gap on staging: today a fresh codeq binary in gs://qbraid-codeq-staging touches no qbraid-lab-base/** file, so build-lab-base never fires and lab-base:latest keeps the old binary until someone runs the trigger by hand. Make it automatic — append a final step to opencode-staging-branch, after the gsutil cp + manifest steps succeed:

gcloud builds triggers run build-lab-base --branch=staging

Scope IAM so the staging codeq build SA can run only the staging build-lab-base trigger (nothing in prod).

Must honor the anti-cascade contract from the 2026-06-11 post-mortem:

• Narrow target — build-lab-base only; never build-foundation, never any docker-stacks-* trigger.
• Per-env + explicit --branch=staging; the SA holds run-permission on only its own env's trigger.
• Idempotent — fire-and-forget, safe at-least-once (a rebuild re-pulls latest).
• No Pub/Sub topic and no chain-rebuild-* trigger — those are being retired.

The first auto-rebuild is guarded by #25's fail-closed gate and observable via #24's stamping. Full spec + guardrails: #19.

Acceptance criteria

• A push to opencode staging auto-fires build-lab-base --branch=staging after the binary uploads.
• The resulting lab-base:latest reports the pushed codeq SHA (verified via Execution: rollout smoke-test — in-build fail-closed SHA gate + operator verify one-liner #25 check B).
• IAM grants the staging codeq SA run-permission on only the staging build-lab-base trigger; no prod grant, no cross-env path.
• No Pub/Sub topic or chain-rebuild-* trigger is introduced; the step targets only build-lab-base.
• The staging auto-rebuild mechanism is documented in CODEQ_DEPLOYMENT.md.

Blocked by

• Execution: stamp git SHA / build-id into codeq --version + manifest.json (both envs) #24 — SHA/build-id stamping (observability of the auto-rebuild).
• Execution: rollout smoke-test — in-build fail-closed SHA gate + operator verify one-liner #25 — rollout smoke-test (the fail-closed gate that guards the first auto-rebuild).

[Kenny-Heitritter]

Implemented across two PRs — open for review (not merged).

• Infra: qBraid/qbraid-infrastructure#620 (commit fe5ab55) — opencode-staging-branch fires build-lab-base --branch=staging after the codeq upload. Cloud Build has no trigger-level IAM, so run-permission is scoped via a single-purpose SA + a minimal cloudbuild.builds.create custom role + resource-scoped impersonation (the shared executor SA gains no standing trigger-run right). Anti-cascade contract honored: narrow build-lab-base target, explicit --branch=staging, idempotent, no Pub/Sub, no chain-rebuild-*.
• Doc: docs(codeq): execution-era CODEQ_DEPLOYMENT.md sections (#25–#29) #42 — staging auto-rebuild mechanism + IAM rationale.

terraform validate passes.