REGBACKLOG-336: manage STRR dev infrastructure with Terraform

[Jacky-Pham]

Summary

• add a dev-only Terraform root in the STRR repository
• adopt the existing STRR email Pub/Sub resources and bulk-validation Eventarc trigger with import blocks
• store state in strr-tools-terraform-state under the strr/dev prefix
• add a manually dispatched, keyless GitHub Actions plan/apply workflow
• keep IAM bootstrap in bcgov/bcregistry-sre and leave BigQuery resources unchanged

Safety boundary

This first change transfers existing dev resources into Terraform state. It does not add the missing cross-environment parity resources. Those changes will be reviewed separately after the import produces a clean plan. Apply is restricted to main.

Dependencies

• strr sa for tf bcregistry-sre#386 creates the existing sa-strr-infra service account and state-bucket access
• Allow STRR Terraform workflow to use infrastructure SA bcregistry-sre#387 adds the GitHub Workload Identity and runtime service-account actAs bindings

Both IAM changes must be applied and merged before running this workflow.

Local validation

• terraform fmt -check -diff -recursive
• terraform init -backend=false -input=false
• terraform validate
• workflow YAML parsed successfully

Initial rollout

1. Merge the IAM changes above.
2. Merge this workflow to main.
3. Run STRR Terraform with action=plan.
4. Require only the expected imports and 0 to add, 0 to change, 0 to destroy.
5. Run action=apply from main to record the imports.
6. Run action=plan again and require no changes.

Ticket: https://hous-hpb.atlassian.net/browse/REGBACKLOG-336

[Jacky-Pham]

hey Jimmy, the SRE IAM changes are merged and applied now. when you have a chance can you review this so I can run the terraform plan?

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

🟡 Changes recommended

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds dev-only Terraform management for existing STRR Pub/Sub and Eventarc infrastructure.

Changes:

• Defines and imports existing dev resources.
• Configures remote state and keyless authentication.
• Adds manual Terraform plan/apply automation.

File summaries

File	Description
terraform/versions.tf	Configures Terraform, provider, and backend.
terraform/variables.tf	Defines dev infrastructure inputs.
terraform/README.md	Documents scope and rollout.
terraform/pubsub.tf	Manages and imports Pub/Sub resources.
terraform/eventarc.tf	Manages and imports the Eventarc trigger.
terraform/dev.tfvars	Supplies dev environment values.
terraform/data.tf	Resolves the Pub/Sub service agent.
terraform/.terraform.lock.hcl	Locks the Google provider.
.gitignore	Excludes Terraform working directories.
.github/workflows/strr-terraform.yaml	Adds manual plan/apply automation.

Review details

Files not reviewed (1)

• terraform/.terraform.lock.hcl: Generated file

• Files reviewed: 8/10 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.