Move remaining STRR services and jobs to Cloud SQL IAM auth

[Jacky-Pham]

what changed

this moves strr-email, strr-pay, and the eight database jobs to Cloud SQL automatic IAM auth using the shared Python Connector and pg8000 setup from bcgov/sbc-connect-common#77.

local development still uses the current password or socket settings when Cloud SQL runtime variables are not set.

• interactions-update now uses the shared helper so IAM wins even when old database variables are still present
• repeated helper tests were removed from the consumers and kept in Add 'max-width' for All Pages #77
• the deployment check now reads the active vault values and confirms every runtime service account matches its deploy project
• the workflow now runs when any covered vault or Cloud Deploy file changes
• Sonar exclusions are limited to the seven job config files because its duplication setting only works at the file level
• the strr-email sandbox instance now uses northamerica-northeast1
• all ten consumers use the same tested helper commit

relationship and dependency

this uses the same Python Connector and pg8000 setup as #1763.

this pr and #1763 do not change the same files, so they can merge in either order after #77 is merged and the pins are updated.

the branch is pinned to the tested #77 commit through my fork for now. #77 needs to merge first, then i will update all ten consumers to the bcgov merge commit and regenerate the locks before this merges.

before merge

merging to main starts the deploy, so these need to be done first:

• add DATABASE_IAM_USERNAME for queue services, DATABASE_JOB_IAM_USERNAME for jobs, DATABASE_INSTANCE_CONNECTION_NAME, and DATABASE_NAME in 1Password
• use bcrbk9-dev for dev, bcrbk9-test for test and uat, bcrbk9-tools for sandbox, and bcrbk9-prod for prod
• make sure each Cloud Run identity matches its database IAM username and has Cloud SQL client access and database login
• give sa-job write access to strr-db because it only has readonly access today and all eight jobs write to the database
• use full deploys or remove DATABASE_PASSWORD, DATABASE_URL, DATABASE_HOST, DATABASE_PORT, and DATABASE_UNIX_SOCKET because the redeploy path keeps old variables

testing

• full suites passed for all ten consumers
• latest interactions-update run: 36 passed, 90.91% coverage
• deployment checks: 3 passed
• shared connector: 21 passed, 3 credential tests skipped
• poetry lock checks, dependency installs, black, isort, actionlint, and diff check passed

[Jacky-Pham]

CI container builds could not fetch the companion commit from the upstream repository before bcgov/sbc-connect-common#77 merges, so the dependency is now pinned to the exact commit on my fork. Once the companion PR merges, I will switch the source URL back to bcgov before this PR is merged.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

🔵 Needs a closer look

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Migrates ten STRR services and jobs to shared Cloud SQL IAM authentication while preserving local database configuration.

Changes:

• Adopts the shared Cloud SQL connector and regenerates dependency locks.
• Updates deployment vault mappings and the email sandbox region.
• Adds deployment contract tests, CI coverage, and Sonar exclusions.

File summaries

File	Description
.github/workflows/strr-gcp-iam-deployment-contracts-ci.yaml	Runs IAM deployment contract checks.
.sonarcloud.properties	Excludes duplicated job configuration.
jobs/auto-approval/.env.sample	Excluded by policy.
jobs/auto-approval/devops/vaults.gcp.env	Maps job IAM database settings.
jobs/auto-approval/poetry.lock	Locks connector dependencies.
jobs/auto-approval/pyproject.toml	Adds the shared connector.
jobs/auto-approval/src/auto_approval/config.py	Uses shared SQLAlchemy settings.
jobs/auto-approval/tests/unit/test_config_cloudsql_iam.py	Tests connector wiring.
jobs/batch-permit-validator/.env.sample	Excluded by policy.
jobs/batch-permit-validator/devops/vaults.gcp.env	Maps job IAM database settings.
jobs/batch-permit-validator/poetry.lock	Locks connector dependencies.
jobs/batch-permit-validator/pyproject.toml	Adds the shared connector.
jobs/batch-permit-validator/src/batch_permit_validator/config.py	Uses shared SQLAlchemy settings.
jobs/interactions-update/.env.sample	Excluded by policy.
jobs/interactions-update/devops/vaults.gcp.env	Maps job IAM database settings.
jobs/interactions-update/poetry.lock	Locks connector dependencies.
jobs/interactions-update/pyproject.toml	Replaces the direct connector dependency.
jobs/interactions-update/src/interactions_update/database.py	Prioritizes shared IAM settings.
jobs/interactions-update/tests/unit/test_database.py	Updates missing-configuration coverage.
jobs/interactions-update/tests/unit/test_database_cloud.py	Tests IAM creator and pool wiring.
jobs/noc_expiry/.env.sample	Excluded by policy.
jobs/noc_expiry/devops/vaults.gcp.env	Maps job IAM database settings.
jobs/noc_expiry/poetry.lock	Locks connector dependencies.
jobs/noc_expiry/pyproject.toml	Adds the shared connector.
jobs/noc_expiry/src/noc_expiry/config.py	Uses shared SQLAlchemy settings.
jobs/provisional-approval/.env.sample	Excluded by policy.
jobs/provisional-approval/devops/vaults.gcp.env	Maps job IAM database settings.
jobs/provisional-approval/poetry.lock	Locks connector dependencies.
jobs/provisional-approval/pyproject.toml	Adds the shared connector.
jobs/provisional-approval/src/provisional_approval/config.py	Uses shared SQLAlchemy settings.
jobs/registration_expiry/.env.sample	Excluded by policy.
jobs/registration_expiry/devops/vaults.gcp.env	Maps job IAM database settings.
jobs/registration_expiry/poetry.lock	Locks connector dependencies.
jobs/registration_expiry/pyproject.toml	Adds the shared connector.
jobs/registration_expiry/src/registration_expiry/config.py	Uses shared SQLAlchemy settings.
jobs/renewal-reminders/.env.sample	Excluded by policy.
jobs/renewal-reminders/devops/vaults.gcp.env	Maps job IAM database settings.
jobs/renewal-reminders/poetry.lock	Locks connector dependencies.
jobs/renewal-reminders/pyproject.toml	Adds the shared connector.
jobs/renewal-reminders/src/renewal_reminders/config.py	Uses shared SQLAlchemy settings.
jobs/strr-backfiller/devops/vaults.gcp.env	Maps job IAM database settings.
jobs/strr-backfiller/poetry.lock	Locks connector dependencies.
jobs/strr-backfiller/pyproject.toml	Adds the shared connector.
jobs/strr-backfiller/src/backfiller/config.py	Uses shared SQLAlchemy settings.
queue_services/strr-email/.env.sample	Excluded by policy.
queue_services/strr-email/devops/gcp/clouddeploy.yaml	Corrects the sandbox database region.
queue_services/strr-email/devops/vaults.gcp.env	Maps service IAM database settings.
queue_services/strr-email/poetry.lock	Locks updated dependencies.
queue_services/strr-email/pyproject.toml	Pins the shared connector.
queue_services/strr-email/src/strr_email/config.py	Uses shared production and test settings.
queue_services/strr-email/tests/unit/test_config_cloudsql_iam.py	Tests connector wiring.
queue_services/strr-pay/.env.sample	Excluded by policy.
queue_services/strr-pay/devops/vaults.gcp.env	Maps service IAM database settings.
queue_services/strr-pay/poetry.lock	Locks updated dependencies.
queue_services/strr-pay/pyproject.toml	Pins the shared connector.
queue_services/strr-pay/src/strr_pay/config.py	Uses shared SQLAlchemy settings.
tests/deployment/test_gcp_iam_vaults.py	Validates mappings, identities, and region.

Review details

Files excluded by content exclusion policy (9)

• jobs/auto-approval/.env.sample
• jobs/batch-permit-validator/.env.sample
• jobs/interactions-update/.env.sample
• jobs/noc_expiry/.env.sample
• jobs/provisional-approval/.env.sample
• jobs/registration_expiry/.env.sample
• jobs/renewal-reminders/.env.sample
• queue_services/strr-email/.env.sample
• queue_services/strr-pay/.env.sample

• Files reviewed: 38/57 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.