Wire Forge-native release infrastructure

infra/releases/storage.tf

@@ -0,0 +1,116 @@
+locals {
+  google_required_services = toset([
+    "storage.googleapis.com",
+  ])
+
+  release_storage_buckets = {
+    releases = {
+      name        = var.google_release_bucket_name
+      description = "Burrow release artifacts"
+      public      = var.google_release_public_read
+    }
+    packages = {
+      name        = var.google_package_bucket_name
+      description = "Burrow signed package repositories"
+      public      = var.google_package_public_read
+    }
+    nix-cache = {
+      name        = var.google_nix_cache_bucket_name
+      description = "Burrow Nix cache backups"
+      public      = var.google_nix_cache_public_read
+    }
+  }
+
+  release_storage_writer_members = setunion(
+    var.google_release_extra_writer_members,
+    toset(["serviceAccount:${var.google_runner_service_account_email}"]),
+  )
+
+  release_storage_writer_grants = var.manage_google ? {
+    for grant in flatten([
+      for bucket_key in keys(local.release_storage_buckets) : [
+        for member in local.release_storage_writer_members : {
+          id         = "${bucket_key}|${member}"
+          bucket_key = bucket_key
+          member     = member
+        }
+      ]
+    ]) : grant.id => grant
+  } : {}
+
+  release_storage_public_grants = var.manage_google ? {
+    for bucket_key, bucket in local.release_storage_buckets : bucket_key => bucket
+    if bucket.public
+  } : {}
+}
+
+resource "google_project_service" "release_storage" {
+  for_each = var.manage_google ? local.google_required_services : toset([])
+
+  project            = var.google_project_id
+  service            = each.value
+  disable_on_destroy = false
+}
+
+resource "google_storage_bucket" "release_storage" {
+  for_each = var.manage_google ? local.release_storage_buckets : {}
+
+  project                     = var.google_project_id
+  name                        = each.value.name
+  location                    = var.google_storage_location
+  uniform_bucket_level_access = true
+  public_access_prevention    = each.value.public ? "inherited" : "enforced"
+  force_destroy               = false
+
+  labels = merge(
+    {
+      project    = "burrow"
+      component  = "release-storage"
+      managed_by = "opentofu"
+      bucket     = each.key
+    },
+    var.tags,
+  )
+
+  versioning {
+    enabled = true
+  }
+
+  cors {
+    origin          = var.google_storage_cors_origins
+    method          = ["GET", "HEAD", "OPTIONS"]
+    response_header = ["Content-Type", "Content-Length", "ETag", "Cache-Control"]
+    max_age_seconds = 3600
+  }
+
+  lifecycle_rule {
+    condition {
+      age                   = 30
+      with_state            = "ARCHIVED"
+      num_newer_versions    = 5
+      matches_storage_class = ["STANDARD"]
+    }
+
+    action {
+      type = "Delete"
+    }
+  }
+
+  depends_on = [google_project_service.release_storage]
+}
+
+resource "google_storage_bucket_iam_member" "release_storage_public_viewer" {
+  for_each = local.release_storage_public_grants
+
+  bucket = google_storage_bucket.release_storage[each.key].name
+  role   = "roles/storage.objectViewer"
+  member = "allUsers"
+}
+
+resource "google_storage_bucket_iam_member" "release_storage_writer" {
+  for_each = local.release_storage_writer_grants
+
+  bucket = google_storage_bucket.release_storage[each.value.bucket_key].name
+  role   = "roles/storage.objectAdmin"
+  member = each.value.member
+}