Execution: wire prod auto-rebuild (gated-off) + verify prod bucket versioning + go-live checklist

[Kenny-Heitritter]

Parent

Map #16 · implements the Phase 2 decision locked in #19 (prod wired-but-gated).

What to build

Replicate the staging auto-rebuild for prod, but leave it disabled behind an explicit go-live gate. Add the same final step to opencode-prod-main:

gcloud builds triggers run build-lab-base-prod --branch=main

…but keep it off — step commented out or the IAM grant withheld — until the prod go-live checklist passes. Separately, confirm/enable object versioning on the prod qbraid-codeq bucket (it is not TF-declared in this repo, only referenced by IAM; the fast break-glass rollback depends on it). Record the prod go-live checklist in CODEQ_DEPLOYMENT.md.

The gate's blocking item — lab-base Trivy restored to --exit-code=1 — is tracked cross-repo (infra#331 / Dstacks#34/#35/#38) and is NOT flipped by this ticket. The rollout-smoke-test go-live item is satisfied by #25.

Lands in qbraid-infrastructure (prod cloud-build-codeq.tf + bucket versioning) + CODEQ_DEPLOYMENT.md. Full spec: #19 → Phase 2.

Acceptance criteria

• opencode-prod-main carries the gcloud builds triggers run build-lab-base-prod --branch=main step, but it is provably inert (commented step or withheld IAM) — a prod codeq push does NOT auto-rebuild yet.
• Object versioning on the prod qbraid-codeq bucket is confirmed enabled (or enabled) and noted in the doc.
• CODEQ_DEPLOYMENT.md records the prod go-live checklist: (1) lab-base Trivy --exit-code=1 [cross-repo], (2) rollout smoke-test exists [Execution: rollout smoke-test — in-build fail-closed SHA gate + operator verify one-liner #25], (3) prod bucket versioning confirmed.
• Same anti-cascade guardrails as staging: narrow build-lab-base-prod target, explicit --branch=main, per-env IAM.

Blocked by

• Execution: enable staging auto-rebuild (codeq push → build-lab-base, scoped IAM) #28 — enable staging auto-rebuild (replicate the proven staging pattern).

[Kenny-Heitritter]

Implemented across two PRs — open for review (not merged).

• Infra: qBraid/qbraid-infrastructure#620 (commits bacf662, cdb6d9f) — prod opencode-prod-main auto-rebuild wired but provably inert: commented step and withheld IAM (fails closed even if uncommented, since the executor SA holds no cloudbuild.builds.create). Same anti-cascade guardrails as staging.
• Doc: docs(codeq): execution-era CODEQ_DEPLOYMENT.md sections (#25–#29) #42 — prod go-live checklist.

Caveats (cannot be closed from source — no live GCP here):

• Prod qbraid-codeq bucket object versioning must be confirmed live (gcloud storage buckets describe gs://qbraid-codeq --format='value(versioning.enabled)') — documented as a manual go-live gate rather than TF-declared (the bucket is out-of-band; importing it without creds risks a create/hijack).
• Go-live gate Added a compass.yml file to manage this repository as a Compass component #1 (lab-base Trivy restored to --exit-code=1) is cross-repo (infra#331 / Dstacks#34/Wire Azure terraform into CI/CD (IaC runner: staging auto-apply, prod gated) #35/Add billing pricing + quota for the 3 models (qbraid-api) #38) and intentionally not flipped here.

terraform validate passes; prod behavior unchanged.