Repository navigation
Changes waiting for the first Azure/GCP deploy after the 2026-10-20 pause #1413
Description
Azure and GCP deploys have been paused since 2026-10-20 (deploy-azure.yml, deploy-gcp.yml and deploy-all.yml are disabled). The owner released the merge hold the same day: "merging is allowed; Azure/GCP apply stays paused" (see #1114). So Azure/GCP PRs merge normally, but some of them change infrastructure that only applies on the first Azure/GCP deploy after the pause. This issue lists them, so that deploy isn't a surprise.
When a PR below merges, it gets ticked here with its merge commit. Whoever re-enables the deploys should read this list first and run a plan against each environment before applying.
Azure/GCP infrastructure that applies on the first deploy (open PRs, not merged yet):
- fix(iac/azure): schedule the server tasks on AKS with CronJobs #1114: schedule the server tasks on AKS with CronJobs (merged as
2a180704) - fix(iac/azure): let the runtime identity write the admin-password secret, and log sync failures as errors #1309: runtime identity writes the admin-password secret (its Go logging part ships immediately on merge) (merged as
ffe19b78; adds ignore_changes on the admin-password secret) - fix(iac): require PostgreSQL 15+ in every environment's version input #1255: require PostgreSQL 15+ in every environment's version input (merged as
e03c1e04) - fix(iac): bound every Terraform provider constraint below the next major #1203: bound every Terraform provider constraint below the next major
- chore(iac): derive the CFN issuer host, create the GCP signing key first, read the dev Function URL from state #1312: CFN issuer host, GCP signing key ordering (its AWS/CloudFormation parts are live on merge)
- sec(iac): narrow three hosted-infra least-privilege grants (GCP CI trust ref, rotation RDS ARN, Cloud Run compute reads) #1290: narrow three hosted-infra least-privilege grants. Also needs a manual GCP
ci-cd-permissionsapply. (merged as898a1665) - sec(ci): delete the GCP staging VPC peering before removing it from state (#330) #1144: delete the GCP staging VPC peering before removing it from state (edits
cleanup-staging.yml, which is still enabled) (merged as12b11b19)
Changes to the disabled deploy workflows (no effect until they're re-enabled):
- fix(ci): fail Azure deploys on unreadable terraform outputs and show logs after a failed health check #1304: fail Azure deploys on unreadable terraform outputs (merged as
5af77d40) - chore(ci): drop the unreachable Fargate caller job from deploy-all (#314) #1228: drop the unreachable Fargate caller job from deploy-all (merged as
99f0b614) - sec(ci): move the remaining run-block ${{ }} interpolations into env (#155) #1147: move run-block
${{ }}interpolations into env (also touches the active Fargate workflow and ci.yml) (merged asacd20b32)
Code-only Azure/GCP PRs (CI guards, tests, Go and frontend code) need no deploy and aren't tracked here.
Opened by IAmJSD's agent at IAmJSD's request (acting owner while the maintainers are away).
Activity
cristim commentedon Nov 5, 2026
Triaged: p3 tracker. It matters only when Azure and GCP deploys are re-enabled; whoever does that reads this list and plans each environment first. Severity medium, because an unread item could apply an unexpected change.
cristim commentedon Nov 10, 2026
Claimed by claude-ui-fix-1 (coordinator assignment): refreshing this tracker. #1203 and #1312 are merged but unchecked, and Azure/GCP infrastructure changes have merged since the list was written. I will post the verified delta as a comment (I did not open this issue, so I leave its body to its author or the owner).
cristim commentedon Nov 10, 2026
Refresh of this list against main (claude-ui-fix-1, from
git log origin/main --since=2026-10-20over the Azure/GCP terraform, arm and federation paths plus each commit's file list and message). The issue body is not mine to edit, so this is the delta; whoever re-enables the deploys should still run a plan per environment.Tick in the body: #1203 merged as
2374b4e9; #1312 merged asfe111246(its AWS/CloudFormation parts were live on merge).Azure/GCP infrastructure merged since the list was written, applies on the first environment deploy:
9a38a451): newgoogle_cloud_scheduler_jobsweeps on Cloud Run and GKE (GKE needsapp_url, still unset for the GCP root: fix(iac): GKE from the GCP environment root schedules no sweeps, so delayed purchases are refused #1767) and new Logic App sweeps on Container Apps.2c43d8d0): thefire_scheduled_purchasessweep is on by default in the aws, azure and gcp roots and in the AKS, Container Apps, Cloud Run and GKE modules.2c11aff3): the hourlyladder_reconciletask on AKS, Container Apps, Cloud Run and GKE, with new root variables.f91d744a): changesmain.tfof the AKS, Container Apps, Cloud Run and GKE modules (theFIRE_SWEEP_SCHEDULEDmarker), so the workloads roll on apply; on the GKE root a purchase delay is refused until fix(iac): GKE from the GCP environment root schedules no sweeps, so delayed purchases are refused #1767 is decided.15226d9b): deletes thecompute/azure/cleanup-functionandcompute/gcp/cleanup-functionmodules, so the first plan may destroy existing cleanup Function resources. Check state before applying.Manual
ci-cd-permissionsapplies (bootstrap, not the deploy workflow):d5dc240f): the Azure federated-credential subjects now use GitHub's immutablerepo:<owner>@<id>/<name>@<id>form, andgithub_owner_idandgithub_repo_idare new required variables, so the plan fails until they are set.e806d5ba): addsazure-db-dev,azure-db-stagingandazure-db-prodfederated credentials (the migrate-azure job fails with AADSTS70021 until applied).4680959b): removesroles/cloudfunctions.developer(GCP) andMicrosoft.Web/serverFarms/*andMicrosoft.Web/sites/*(Azure) from the ci-cd-permissions roots.d16a94f5): variable description only.No deploy effect: #1306 (
1ceaafd1, unused ARM parameter), #1439 (0be0374f, lock-file hashes; the env roots now init with-lockfile=readonly), #1587 (docs), #1507 (AWS-target CloudFormation).Read from commit contents, not from a plan: confirm each item with
terraform planper environment before applying.