Component Repository

The uk-dvt-gcloud-core-projects repository is the central orchestration hub for the AI Platform. It provisions the baseline infrastructure scaffold for all platform components, services, agents, and sandboxes—including GCP projects, IAM permissions, service accounts, GitHub repositories, and GCS remote state buckets.

Detailed application workloads (e.g. Cloud Run services, Agent APIs, proxies, or databases) are maintained in each component's dedicated repository and deployed via their respective pipelines.

---

Repository Layout

components/          # Declared platform components (foundations, services, agents, sandboxes)
modules/             # Reusable OpenTofu/Terraform orchestration modules
  component-scaffold/ # Core orchestration module for project & repository provisioning
  github-repository-factory/
  service-onboarding-*/
templates/           # Standard starter templates for new components
  agents/            # Agent templates (agents-cli, agent-runtime)
  sandboxes/         # Sandbox templates (default, gemini-enterprise)
  misc/              # General templates (iac, empty)
config.tfvars        # Shared platform configuration
config_<env>.tfvars  # Environment-specific configuration (common, development, staging, production)
.github/workflows/   # CI/CD pipelines (callable-opentofu.yml, plan.yml, apply.yml, destroy.yml)

---

Component Provisioning Workflow

To declare and provision a new component:

1. Copy the desired template folder to components/<component_type>/<component_name>/.
2. Configure config_component.tfvars with the component name, code, team access and other required inputs.
3. Submit a pull request to uk-dvt-gcloud-core-projects for automated plan and apply.

Merging to main provisions the GCP project, IAM baselines, and dedicated GitHub repository:

uk-dvt-gcloud-<component_name>-<repo_name>

---

Shared CI/CD Pipeline

Component and foundation repositories execute OpenTofu operations using the central callable workflow:

uses: devoteamgcloud/uk-dvt-gcloud-core-projects/.github/workflows/callable-opentofu.yml@main
with:
  environment: development
  command: plan
  module_path: envs/development
  bucket_prefix: uk-dvt-gcloud-<component_name>-<repo_name>/development

Callable Workflow Inputs

Input	Required	Description
environment	Yes	Deployment environment (common, development, staging, production)
command	Yes	OpenTofu command (plan, apply, destroy)
module_path	Yes	Relative path to the target OpenTofu module directory
bucket_prefix	Yes	GCS state key prefix
enable_github_factory_app	No	Set true to generate a GitHub App token for the GitHub provider
force_unlock_id	No	Release a stale GCS state lock before executing
safeguard_deleted_path	No	Target directory path that must not exist before destroy executes

---

Local Development & Validation

Authentication

Authenticate using Application Default Credentials (ADC):

gcloud auth login
gcloud auth application-default login

Validation

Export placeholder GitHub App variables and run validation:

export TF_VAR_github_app_installation_id="0"
export TF_VAR_github_app_id="0"
export TF_VAR_github_app_pem_file=""

tofu init
tofu validate