docs(cli): add legacy Compute Admin migration checklist to GCP setup by cristim · Pull Request #2137 · LeanerCloud/cloud-commitments-cli

cristim · 2026-10-07T12:57:04Z

Adds the legacy Compute Admin migration checklist tracked in #2123. Existing wizard installations retain broad grants until their owner reviews and authorizes removal.

The checklist inventories direct and inherited policies with resource and condition attribution, inspects exact narrow role grants, removes only individually approved bindings at the owning resource, and tests effective permissions after broad access stops masking missing replacements. The supported Resource Manager permissions API replaces an invalid gcloud command. Credential recovery, conditional grants and operator rollback require explicit authorization.

Verification at 38124c788dc4b84689d05a2ad05dc86f1a071be3:

Independent Codex full-diff adversarial review clean; review findings resolved in two correction passes.
Offline nested-policy regression: old query misses inherited binding, corrected query preserves scope/member/condition.
Documented curl command executes against a loopback HTTP fixture with exact method/path/headers/JSON permissions. Old nonexistent gcloud command reproduces exit 2.
Fresh Go build, Markdown lint, diff checks and all applicable commit hooks passed.
Both CI workflows passed on this exact head.

Evidence is offline fixtures and local HTTP integration. No live IAM propagation or deployed read-only workflow verified, no cloud mutation or purchase performed. Live installation inventory and remediation remain tracked by #2123 pending project-owner authorization. This PR does not close that issue.

Refs #2123

Older configure-gcp wizards granted roles/compute.admin and rerunning the current wizard preserves that binding. Document the operator checklist for the inventory-and-remediation part of #2123: inventory broad grants with owner authorization, establish the narrow roles, validate them live without purchasing, and revoke only after explicit approval.

coderabbitai · 2026-10-07T12:57:18Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: LeanerCloud/cloud-commitments-cli/.coderabbit.yaml
Review profile: CHILL
Plan: Essentials
Run ID: 0a242b98-e7d6-42a1-bee8-8c01f7104027

📥 Commits

Reviewing files that changed from the base of the PR and between ad57326 and 38124c7.

📒 Files selected for processing (1)

docs/cli/cloud-setup.md

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📝 Walkthrough

Walkthrough

The GCP setup guide replaces a brief recommendation with a checklist for reviewing legacy Compute Admin grants. It documents inventory, narrow-role validation, approved binding removal, access checks, and rollback steps.

Changes

Legacy GCP grant migration

Layer / File(s)	Summary
Document the grant migration checklist `docs/cli/cloud-setup.md`	The guide describes how to inventory project and inherited policies, check narrow replacement roles, and remove only authorized bindings while preserving conditions. It specifies read-only validation, limits on offline checks, and rollback steps. It prohibits purchasing, automatic key recovery, and unauthorized changes.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other · Severity of issue fixed: High

Merge Risk: ⚪ Minimal · up to 38124

No actionable merge-blocking risk remains in the reviewed documentation change.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The change implements the documentation objectives in `#2123`. It adds commands to inventory project and inherited folder or organization bindings without IAM mutation. It documents the narrow `roles/co…
Out of Scope Changes check	✅ Passed	The whole-PR diff changes only `docs/cli/cloud-setup.md`. The checklist commands, rollback guidance, credential precautions, condition handling, and verification notes directly support the migration a…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding a legacy Compute Admin migration checklist to the GCP setup documentation.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

cristim · 2026-10-07T12:57:54Z

@coderabbitai review

coderabbitai · 2026-10-07T12:58:02Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Address independent review on #2137: cover inherited folder/org bindings with get-ancestors-iam-policy, note that test-iam-permissions silently omits missing permissions, restore the operator identity before the revocation step, flag the --condition failure mode on conditional bindings, and cover installs whose local key file was already removed.

cristim · 2026-10-07T13:04:11Z

Independent review pass 1 found one actionable (project-only policy would miss inherited folder/org grants) plus two nitpicks and two notes; all five addressed in 82cdc92: added get-ancestors-iam-policy for inherited bindings, test-iam-permissions omission caveat, operator identity restore before the revocation step, IAM condition heads-up, and key-file-path guidance. Re-review in flight.

@coderabbitai review

coderabbitai · 2026-10-07T13:04:18Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim · 2026-10-07T13:13:27Z

@coderabbitai full review

coderabbitai · 2026-10-07T13:13:37Z

⚠️ Action not completed

Review rate limited.

Your included review limit is currently reached under our Fair Usage Limits Policy. Your current included review allowance is based on your included PR review attempts over the past 7 days. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 27 minutes.

cristim · 2026-10-07T14:11:12Z

@coderabbitai full review

coderabbitai · 2026-10-07T14:11:19Z

⚠️ Action not completed

Review rate limited.

Your included review limit is currently reached under our Fair Usage Limits Policy. Your current included review allowance is based on your included PR review attempts over the past 7 days. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 31 minutes.

cristim · 2026-10-07T15:03:52Z

Codex takeover audit: head remains 82cdc92; CI re-fetched green and merge state CLEAN. Recovered Kimi wire history confirms both independent review passes used kimi-code/k3, not the exact claude-opus-5-5 required by CLAUDE.md. Direct invocation of the pinned reviewer failed: Not logged in; Please run /login. Merge is held for exact-model review at this SHA and recording its verdict here. The owner CodeRabbit quota waiver does not waive that reviewer gate. No merge, IAM mutation, purchase, or new CR trigger performed. Existing live inventory remains tracked in #2123 pending project-owner authorization.

Use ancestor policy field paths and the supported IAM permissions API. Inspect replacement bindings before approved removal, then verify access after broad grants stop masking missing narrow permissions. Refs #2123

cristim · 2026-10-07T20:10:45Z

@coderabbitai full review

coderabbitai · 2026-10-07T20:14:55Z

⚠️ Action not completed

Review rate limited.

Your included review limit is currently reached under our Fair Usage Limits Policy. Your current included review allowance is based on your included PR review attempts over the past 7 days. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 54 minutes.

cristim · 2026-10-07T20:17:57Z

Owner override applied. Independent Codex review clean at exact head 38124c7. Four migration defects fixed and review refinements closed. Fresh build, Markdown lint, diff check, and all applicable commit hooks passed. Offline regression fixture demonstrates old ancestor query misses inherited grant and corrected query retains scope/member/condition. Documented REST curl request executed against local HTTP fixture with exact method/path/headers/body. Evidence is offline/local; live IAM propagation and deployed analysis remain uncovered and tracked in #2123 pending owner authorization. No cloud mutation or purchase. CI watchers armed for both current-head workflows; CR full review requested with one watcher.

cristim added priority/p1 Next up; this sprint severity/high Significant harm urgency/this-sprint Within the current sprint impact/few Limited audience effort/m Days type/security Security finding triaged Item has been triaged labels Oct 7, 2026

cristim mentioned this pull request Oct 7, 2026

test(cli): TestRecommendationCompletenessCommand/savingsplans-database/api-error is flaky in CI #2140

Open

docs(cli): correct legacy grant inventory and verification

38124c7

Use ancestor policy field paths and the supported IAM permissions API. Inspect replacement bindings before approved removal, then verify access after broad grants stop masking missing narrow permissions. Refs #2123

cristim merged commit bc0a967 into main Oct 7, 2026
12 checks passed

Conversation

cristim commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

cristim commented Oct 7, 2026

Uh oh!

coderabbitai Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cristim commented Oct 7, 2026

Uh oh!

coderabbitai Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cristim commented Oct 7, 2026

Uh oh!

coderabbitai Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cristim commented Oct 7, 2026

Uh oh!

coderabbitai Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cristim commented Oct 7, 2026

Uh oh!

cristim commented Oct 7, 2026

Uh oh!

coderabbitai Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cristim commented Oct 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cristim commented Oct 7, 2026 •

edited

Loading

coderabbitai Bot commented Oct 7, 2026 •

edited

Loading

coderabbitai Bot commented Oct 7, 2026 •

edited

Loading

coderabbitai Bot commented Oct 7, 2026 •

edited

Loading

coderabbitai Bot commented Oct 7, 2026 •

edited

Loading

coderabbitai Bot commented Oct 7, 2026 •

edited

Loading

coderabbitai Bot commented Oct 7, 2026 •

edited

Loading