run_5efa98bf6943d6ad

input

{
  "request": "Triage Jira ticket SREIN-1694: Add GCP_DRYRUN_SERVICE_ACCOUNT_EMAIL secret to mozilla/experimenter for BigQuery SQL dry-run CI",
  "references": [
    "https://mozilla-hub.atlassian.net/browse/SREIN-1694"
  ],
  "sourceContext": {
    "issue": "SREIN-1694"
  }
}

summary

SREIN-1694 requests provisioning of a GCP service account (exposed as the GCP_DRYRUN_SERVICE_ACCOUNT_EMAIL secret) for the mozilla/experimenter GitHub repo so a new BigQuery SQL dry-run CI check can authenticate to the shared dry-run Cloud Function, mirroring the existing setup in mozilla/metric-hub. The repo already has the two other required config values (GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER and GCPV2_WORKLOAD_IDENTITY_POOL_PROJECT_NUMBER); only the service account is missing. The ticket is unassigned/Backlog with no comments yet, so it needs SRE-IN triage to decide between reusing the metric-hub SA or provisioning a new one, and to assign an owner.

findings

• Ticket is a straightforward secret/IAM provisioning request modeled directly on an existing working pattern (mozilla/metric-hub), reducing ambiguity and risk.
• Two of the three required GitHub Actions config values already exist in the experimenter repo; only the service account email secret is outstanding.
• Requester offers two viable resolution paths, giving SRE-IN a choice based on security posture: reuse the existing metric-hub SA (simpler, but broadens which repos can invoke the dry-run function under one identity) vs. provision a dedicated SA scoped with Cloud Functions Invoker on the target function (better least-privilege isolation per repo, slightly more setup work).
• Ticket has zero comments and is still in Backlog status, indicating it has not yet been triaged/assigned to an SRE-IN engineer for action.
• No linked runbook or Confluence design doc was found in the ticket description or comments to consult for additional context; guidance should reference the metric-hub CI/IAM setup as the source of truth instead.

proposed actions

Thanks for the clear writeup. To move this forward, SRE-IN needs a decision on the two options:

1) Reuse the metric-hub GCP_DRYRUN_SERVICE_ACCOUNT_EMAIL service account for experimenter as well (fastest path, but means one SA is shared/trusted by two repos' workload identity federation configs for invoking the shared dry-run Cloud Function).
2) Provision a new, dedicated service account scoped with only the 'Cloud Functions Invoker' role on the moz-fx-data-shared-prod dryrun function, and wire it into experimenter's existing GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER / GCPV2_WORKLOAD_IDENTITY_POOL_PROJECT_NUMBER workload identity federation setup (better least-privilege isolation, matches per-repo SA pattern if that's our convention).

Recommendation: prefer option 2 (dedicated SA) for isolation/least-privilege unless there's an established convention of sharing this SA across repos - can someone confirm how metric-hub's SA was scoped originally? Once we know which path, we'll create/verify the SA, grant Cloud Functions Invoker on the dryrun function, bind it to experimenter's workload identity pool, and add the email as the GCP_DRYRUN_SERVICE_ACCOUNT_EMAIL secret in mozilla/experimenter. Moving this out of Backlog and assigning for pickup - please confirm target sprint/priority.

tool calls

[
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "SREIN-1694"
    },
    "result": {
      "key": "SREIN-1694",
      "summary": "Add GCP_DRYRUN_SERVICE_ACCOUNT_EMAIL secret to mozilla/experimenter for BigQuery SQL dry-run CI",
      "status": "Backlog",
      "description_text": "We're adding a BigQuery SQL dry-run CI check to the  mozilla/experimenter  repo, following the same pattern as  mozilla/metric-hub . metric-hub uses a  GCP_DRYRUN_SERVICE_ACCOUNT_EMAIL  secret and  GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER  variable to authenticate against the dryrun Cloud Function at  https://us-central1-moz-fx-data-shared-prod.cloudfunctions.net/dryrun . Can we either: Reuse the same service account already set up for metric-hub, or Get a new service account with\u00a0 Cloud Functions Invoker \u00a0permission on that function We already have  GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER  and  GCPV2_WORKLOAD_IDENTITY_POOL_PROJECT_NUMBER  in the experimenter repo. We just need the service account email to add as  GCP_DRYRUN_SERVICE_ACCOUNT_EMAIL .",
      "comment_count": 0,
      "comments": []
    }
  }
]

log