From a3ab801960945efd8235dfd241e536de85cd38e7 Mon Sep 17 00:00:00 2001 From: Senih Bayankulu Date: Wed, 17 Jun 2026 20:02:51 +0300 Subject: [PATCH] docs(module06): add pre-deploy evidence and approval gate --- .../MODULE_06C_PRE_DEPLOY_APPROVAL_GATE.md | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 docs/modules/module-06-cloud-run/MODULE_06C_PRE_DEPLOY_APPROVAL_GATE.md diff --git a/docs/modules/module-06-cloud-run/MODULE_06C_PRE_DEPLOY_APPROVAL_GATE.md b/docs/modules/module-06-cloud-run/MODULE_06C_PRE_DEPLOY_APPROVAL_GATE.md new file mode 100644 index 0000000..6dc67d3 --- /dev/null +++ b/docs/modules/module-06-cloud-run/MODULE_06C_PRE_DEPLOY_APPROVAL_GATE.md @@ -0,0 +1,56 @@ +# Module 06-C — Pre-Deploy Evidence and Approval Gate + +## Purpose + +This document serves as the final **Pre-Deploy Evidence and Approval Gate** for Module 06 (Cloud Run Deployment). In compliance with [docs/GUARDRAILS.md](file:///C:/Users/YeniKullanici/chrome-devtools-cloud-migration-lab/docs/GUARDRAILS.md) and [docs/HEALTH_ECOSYSTEM_BOUNDARIES.md](file:///C:/Users/YeniKullanici/chrome-devtools-cloud-migration-lab/docs/HEALTH_ECOSYSTEM_BOUNDARIES.md), this gate must be signed off before executing any cloud deployment commands. + +--- + +## 1. Go / No-Go Decision Matrix + +An active deployment is authorized to proceed *only* if all of the following conditions evaluate to a **GO** status: + +| Check Target | Evaluation Criterion | Current Status | Verdict | +|---|---|---|---| +| **1. Budget Alert** | GCP Billing account must have active alert notifications set at or below the $5.00 limit. | Verified Active | **GO** | +| **2. Secret Screening** | Repo guardrail scan must confirm zero tracked API keys, private keys, or `.env` files. | Verified Clean | **GO** | +| **3. Access Restrictions** | Ingress and IAM settings must enforce authenticated access only (`--no-allow-unauthenticated`). | Configured in SOP | **GO** | +| **4. Local Containers** | Local build (via Buildpacks or Dockerfile) must run successfully in a local loopback port. | Verified in Mod 04/05 | **GO** | +| **5. Minimization Caps** | Resource allocation must be capped (`--max-instances 1`, memory `512MiB`, scale-to-zero). | Configured in SOP | **GO** | + +--- + +## 2. Gated Pre-Deploy Sign-Off Checklist + +The following items must be verified before executing the deployment commands defined in [MODULE_06B_CLOUD_RUN_RUNBOOK_APPROVAL.md](file:///C:/Users/YeniKullanici/chrome-devtools-cloud-migration-lab/docs/modules/module-06-cloud-run/MODULE_06B_CLOUD_RUN_RUNBOOK_APPROVAL.md): + +* **Secret Exposure Check**: + - [x] No credentials or API keys exist in the source code. + - [x] No `.env` files are tracked by git. + - [x] Custom IAM Service Account name is generated and does not leak personal emails. + +* **Cost Spiking Prevention**: + - [x] `--max-instances 1` is appended to the deploy command. + - [x] `--min-instances 0` is appended to ensure scale-to-zero. + - [x] `--cpu-throttling` is active to disable billing for idle containers. + +* **Secure Network Ingress**: + - [x] `--no-allow-unauthenticated` is active to restrict endpoints to authenticated users only. + - [x] Public URL is excluded from public-facing documents. + +--- + +## 3. Deployment Authorization Verdict + +> [!IMPORTANT] +> **Current Status: GATED (Manual Review Required)** +> +> Under the strict guidelines of [docs/GUARDRAILS.md](file:///C:/Users/YeniKullanici/chrome-devtools-cloud-migration-lab/docs/GUARDRAILS.md), AI agents are **prohibited** from executing live deployment commands (`gcloud run deploy`) or enabling GCP service APIs directly. +> +> This gate requires manual developer intervention. The developer must review the runbook commands, execute them in an authenticated GCP shell, and confirm successful scaling and cost behaviors. + +--- + +## 4. Next Step + +* **Next Step**: Once manual review is approved and deployment is executed by the developer, proceed to `Module 06-D` to gather post-deployment DevTools and Performance evidence.