fix: use a custom service account for Cloud Build

.github/workflows/codehealth.yaml

@@ -44,3 +44,9 @@ jobs:
 
  - name: Execute "npm run markdown-link-check"
  run: npm run markdown-link-check
+
+ - name: Use terraform
+ uses: hashicorp/setup-terraform@v3
+
+ - name: terraform validate deployments
+ run: npm run terraform-validate

.husky/pre-commit

@@ -5,4 +5,6 @@ npm run eslint
 npm run markdown-link-check
 npm run mdlint
 npm run typecheck
+npm run terraform-validate
 npm test
+

package.json

@@ -24,6 +24,7 @@
  "start-forwarder-function": "functions-framework --target=forwardFromHTTP",
  "start-poller-function": "functions-framework --target=checkSpannerScaleMetricsHTTP",
  "start-scaler-function": "functions-framework --target=scaleSpannerInstanceHTTP --port=8081",
+ "terraform-validate": "set -e ; package_root=\"$(pwd)\"; for x in gke/decoupled gke/unified cloud-functions/distributed/app-project cloud-functions/distributed/autoscaler-project cloud-functions/per-project ; do cd \"$package_root/terraform/$x\" ; echo \"\n\nValidating Terraform in $PWD\n\n\" ; terraform init ; terraform validate; done",
  "test": "NODE_ENV=test nyc --reporter=text mocha --recursive src --extension=.test.js",
  "test-e2e": "pushd terraform/cloud-functions/per-project/test && go test -run . -timeout 60m --tags=e2e && popd",
  "typecheck": "tsc --project jsconfig.json --maxNodeModuleJsDepth 0 --noEmit",

terraform/cloud-functions/distributed/app-project/main.tf

@@ -18,7 +18,7 @@ terraform {
  required_providers {
  google = {
  source = "hashicorp/google"
- version = "~> 5.43.0"
+ version = ">= 6.2.0"
  }
  }
 }

terraform/cloud-functions/distributed/autoscaler-project/main.tf

@@ -18,7 +18,7 @@ terraform {
  required_providers {
  google = {
  source = "hashicorp/google"
- version = "~> 5.43.0"
+ version = ">= 6.2.0"
  }
  }
 }
@@ -54,6 +54,7 @@ module "autoscaler-functions" {
  poller_sa_email = google_service_account.poller_sa.email
  scaler_sa_email = google_service_account.scaler_sa.email
  forwarder_sa_emails = var.forwarder_sa_emails
+ build_sa_id = module.autoscaler-base.build_sa_id
 }
 
 module "firestore" {

terraform/cloud-functions/per-project/main.tf

@@ -18,7 +18,7 @@ terraform {
  required_providers {
  google = {
  source = "hashicorp/google"
- version = "~> 5.43.0"
+ version = ">= 6.2.0"
  }
  }
 }
@@ -53,6 +53,7 @@ module "autoscaler-functions" {
  region = var.region
  poller_sa_email = google_service_account.poller_sa.email
  scaler_sa_email = google_service_account.scaler_sa.email
+ build_sa_id = module.autoscaler-base.build_sa_id
 }
 
 module "firestore" {