fix(relay): staging director deploys set the admin identity the director trusts to gha-relay

[Jinwoo-H]

	Files	Added	Deleted	Net
Test	2	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​25	0	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​25
Prod	2	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​9	0	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​9

ELI5

The staging director only accepts admin calls from a robot account called gha-deploy. Every staging workflow, and every staging cell, uses a different robot account, gha-relay. So the workflows' admin calls to the director are rejected. This makes staging director deploys tell the director to trust gha-relay.

What Changed

• Before: the live staging director has ORCA_RELAY_DEPLOY_SERVICE_ACCOUNT=orca-cloud-staging-gha-deploy@…. Terraform declares gha-relay (relay-shared.tf, the staging arm of relay_github_deploy_service_account_email), and the c1, c2 and c4 instance templates already carry gha-relay. Every /v1/admin/* call that a staging workflow makes to the director with gha-relay's token gets 401. That includes fix(relay): the cell switch tool changes only the named switches #27056's admit-mode guard, the cell-flags tool and verifyRehomeDisabled.
• After: deploy-relay-blue-green.mjs gains --deploy-service-account, which must be an account in the selected project. When it is passed, the candidate and rollback revisions get ORCA_RELAY_DEPLOY_SERVICE_ACCOUNT. When it is omitted, the serving revision's value carries over, so the behavior is unchanged. cloud-deploy-relay-staging.yml passes vars.STAGING_GCP_RELAY_DEPLOY_SERVICE_ACCOUNT, the same identity it authenticates as.

Who owns the value: the deploy, not Terraform

A targeted Terraform plan of google_cloud_run_v2_service.relay on staging is far wider than this one variable. It moves the runtime account, and changes concurrency from 1000 to 80, timeout from 3600s to 30s, and scaling. It strips ORCA_RELAY_IMAGE_DIGEST and mints a revision outside deployDirector's guards. The deploy already owns every other live director env value, so this keeps one owner. No Terraform change is needed: Terraform already says gha-relay.

Order

Stacked on #27118. The first staging deploy after both merge must be #27118's bootstrap-runtime-identity=true deploy. That path skips the rehome check against the serving origin, which still trusts gha-deploy. Its rollback and candidate revisions carry the new value, so every later call with gha-relay's token succeeds there. A non-bootstrap deploy before the bootstrap fails closed.

The bootstrap must deploy the serving image digest, with reserve-placement=preserve and shadow-seat-feed-cells=preserve. #27056's reserve guard (assertDirectorTrustsAdminCaller) refuses by name when the serving director trusts a different account than the caller, and it runs whenever the image or those settings change. With the same image and settings, it is skipped by design, and that is the only way through while the serving director still trusts gha-deploy. Deploy D after the bootstrap.

Apply

No Terraform. The director change happens in the bootstrap deploy.

Production

Zero. No Terraform file changes. No production workflow passes --deploy-service-account, so production deploys carry their serving value over exactly as before.

Testing

• New deploy-relay-blue-green test: the value is set only when asked, and a foreign-project account is refused.
• The staging argv-parse test now includes the new flag.
• deploy-relay-blue-green (43), relay-staging-deploy-identity, relay-staging-capacity-identity and production-cloud-sql-rollout-lock pass.

Visual Proof

N/A: CI and deploy tooling only.

[coderabbitai]

📝 Walkthrough

📝 Walkthrough

Walkthrough

The staging Relay workflow now passes its configured deploy service account to the blue/green deployment script. The script validates the identity against the selected project and sets ORCA_RELAY_DEPLOY_SERVICE_ACCOUNT for director deployments when the identity is provided. Tests cover configuration handling and workflow argument passing.

---

---

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 90907

The staging deploy uses the same service account for authentication and director configuration, and both revisions receive the setting. The remaining recommendation strengthens regression coverage; no material merge-blocking risk is established.

Pre-merge checks | 3 | 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check		The description gives a clear ELI5, detailed before-and-after behavior, deployment order, scope, production impact, testing, and visual-proof statement. However, it omits the required Linked Issue and…	Add an actual issue reference in the required "Fixes #" format. Add or explicitly address the required Why, Review, Agent skill upstream boundary, Notes, and Checklist sections. Preserve the existing deployment-order and testing deta…

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly identifies the main change: staging Relay director deploys now use the trusted gha-relay admin identity.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (1 skipped: 1 unsupported.)

---

Full details: Description check

Explanation

The description gives a clear ELI5, detailed before-and-after behavior, deployment order, scope, production impact, testing, and visual-proof statement. However, it omits the required Linked Issue and several template sections, including the checklist and explicit Why section.

Resolution

Add an actual issue reference in the required "Fixes #<issue>" format. Add or explicitly address the required Why, Review, Agent skill upstream boundary, Notes, and Checklist sections. Preserve the existing deployment-order and testing details.

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

cloud/dev/scripts/deploy-relay-blue-green.test.mjs (1)

1028-1047: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Assert deploy identity on both generated revisions.

The changed test validates only directorDeploymentEnvironment. It does not exercise either revision deployment. Add the deploy identity to the existing end-to-end fixture and assert it for both revisions.

Suggested fix

   const config = {
     project: 'onorca-cloud-staging',
     'capacity-service-account':
-      'orca-cloud-staging-gha-cap@onorca-cloud-staging.iam.gserviceaccount.com'
+      'orca-cloud-staging-gha-cap@onorca-cloud-staging.iam.gserviceaccount.com',
+    'deploy-service-account':
+      'orca-cloud-staging-gha-relay@onorca-cloud-staging.iam.gserviceaccount.com'
   }
...
     assert.equal(
       harness.state.revisions.get(revision).env.ORCA_RELAY_CAPACITY_SERVICE_ACCOUNT,
       config['capacity-service-account']
     )
+    assert.equal(
+      harness.state.revisions.get(revision).env.ORCA_RELAY_DEPLOY_SERVICE_ACCOUNT,
+      config['deploy-service-account']
+    )

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3936c80a-c025-4862-b18d-0397f7b81656

📥 Commits

Reviewing files that changed from the base of the PR and between b154baf and 9090786.

📒 Files selected for processing (4)

• .github/workflows/cloud-deploy-relay-staging.yml
• cloud/dev/scripts/deploy-relay-blue-green.mjs
• cloud/dev/scripts/deploy-relay-blue-green.test.mjs
• cloud/dev/scripts/relay-staging-deploy-identity.test.mjs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.