[cristim]

Closes #1597

What changed: removes three grants left unused since #1591 retired the cleanup Cloud Function and Function App modules: GCP roles/cloudfunctions.developer, Azure Microsoft.Web/serverFarms/* and Microsoft.Web/sites/*, from the ci-cd-permissions roots.

Why safe: grep of terraform/ finds no google_cloudfunctions*, function/web app or service plan resources. The Azure scheduled tasks use Logic Apps (Microsoft.Logic), which is untouched.

Evidence: 3 deletions, 2 files; pre-commit hooks pass. terraform is not runnable on this host, so no validate was run; the change only removes list entries.

Note: takes effect only when a human applies those roots. Nothing was applied.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 14 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-platform
• Branch: chore/drop-unused-cleanup-fn-grants
• File: .coderabbit.yaml
• Commit: 6e57c68
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: b5755f9d-035e-4a31-8851-a44a8f1915b1

Commits

Reviewing files that changed from the base of the PR and between bfb0654 and 6e57c68.

Files selected for processing: 2

• terraform/environments/azure/ci-cd-permissions/locals_compute.tf
• terraform/environments/gcp/ci-cd-permissions/service_account.tf

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[cristim]

APPROVE @ 6e57c68 by claude-nibblets

Cold review of #1877 (closes #1597, 3 deleted list entries in 2 files; privilege reduction only). Removes Microsoft.Web/serverFarms/* and Microsoft.Web/sites/* from the Azure ci-cd-permissions locals and roles/cloudfunctions.developer from the GCP ci-cd service account.

Verified that nothing in the repo still needs them, instead of taking the PR body's word:

• A search of terraform/ at this head for Cloud Functions, Function Apps, App Service plans, web apps, static web apps and Logic Apps Standard resources finds none. The only Microsoft.Web text left is a comment in terraform/modules/compute/azure/container-apps/scheduled-tasks.tf that says the workflows are Consumption-tier Microsoft.Logic/workflows, which stay granted (Microsoft.Logic/workflows/* and /locations/* are untouched).
• The GCP compute module uses Cloud Run (google_cloud_run_v2_service) and Cloud Scheduler jobs, which do not use the Cloud Functions role.
• Terraform validate for aws, azure and gcp and the Azure role-actions parity job (ARM vs TF) pass at this head, so the Azure list is still in step with the ARM template. Terraform was not run locally by me; CI is the evidence.

Non-blocking: the change takes effect only when a human applies those roots, as the PR says; it only removes permissions, so the worst case is a later deploy failing on a missing grant, and I found no resource that would need one.

CI at this head: 41 pass, 1 skipping (CodeRabbit), including Lint Code, CI Success and the three Terraform validations.