From d2db405b361acbeb5958f569f3f8181cfbe5bc7d Mon Sep 17 00:00:00 2001
From: Scott McDonald <scott.mcdonald@onixnet.com>
Date: Fri, 28 Aug 2026 17:52:39 +0000
Subject: [PATCH] fix(gemini-enterprise): parse hyphenated tenant ids and the
 FAST tenant bucket name in brownfield discovery

deploy.sh derived the tenant from a brownfield project id with
'cut -d- -f3', so a FAST tenant named ten-1 (project prefix-prod-ten-1-main-0)
came back as 'ten' and every derived name (iac-core project, state bucket,
keyring) pointed at resources that do not exist; discovery then fell through
to the custom-brownfield path. Take everything between the environment and
the '-main-0' suffix instead, and treat a non-matching id as no tenant.

The state bucket check also looked for <prefix>-<env>-<tenant>-iac-0, while
1-resman creates the tenant state bucket as <prefix>-tn-<env>-<tenant>-0
(branch-tenants.tf, module tenant-core-gcs); use that name.

Signed-off-by: Scott McDonald <scott.mcdonald@onixnet.com>
---
 .../fedramp-high/gemini-enterprise/deploy.sh       | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/blueprints/fedramp-high/gemini-enterprise/deploy.sh b/blueprints/fedramp-high/gemini-enterprise/deploy.sh
index 6e66f8747..a8ed31887 100755
--- a/blueprints/fedramp-high/gemini-enterprise/deploy.sh
+++ b/blueprints/fedramp-high/gemini-enterprise/deploy.sh
@@ -525,9 +525,15 @@ discover_infrastructure() {
 
     if [[ "$IS_BROWNFIELD" == "true" ]]; then
         # 1. Extract Environment and Tenant
-        # Format: prefix-env-tenant-main-0
+        # Format: prefix-env-tenant-main-0. The tenant id may itself contain
+        # hyphens (FAST tenants are typically named like "ten-1"), so take
+        # everything between the environment and the "-main-0" suffix rather
+        # than the third hyphen-separated field.
         ENVIRONMENT=$(echo "$PROJECT_ID" | cut -d'-' -f2)
-        TENANT_VAL=$(echo "$PROJECT_ID" | cut -d'-' -f3)
+        TENANT_VAL=$(echo "$PROJECT_ID" | sed -E 's/^[^-]+-[^-]+-(.+)-main-0$/\1/')
+        if [[ "$TENANT_VAL" == "$PROJECT_ID" ]]; then
+            TENANT_VAL=""
+        fi
         
         # Validate extraction (basic check)
         if [[ -z "$ENVIRONMENT" || -z "$TENANT_VAL" ]]; then
@@ -573,7 +579,9 @@ discover_infrastructure() {
         fi
 
         # 3. Check State Bucket
-        POTENTIAL_BUCKET="${PREFIX}-${ENVIRONMENT}-${TENANT}-iac-0"
+        # 1-resman names the tenant state bucket <prefix>-tn-<env>-<tenant>-0
+        # (branch-tenants.tf, module tenant-core-gcs).
+        POTENTIAL_BUCKET="${PREFIX}-tn-${ENVIRONMENT}-${TENANT}-0"
         echo "Checking for Terraform State Bucket: ${POTENTIAL_BUCKET}..."
         if gcloud storage buckets describe "gs://${POTENTIAL_BUCKET}" &>/dev/null; then
             STATE_BUCKET="${POTENTIAL_BUCKET}"