locals {
  deploy_service_account_member = "serviceAccount:${google_service_account.deploy.email}"
  github_repository_principal   = "principalSet://iam.googleapis.com/projects/${var.project_number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.github_actions.workload_identity_pool_id}/attribute.repository/${var.github_repository}"
}

resource "google_service_account_iam_binding" "github_actions_workload_identity_user" {
  service_account_id = google_service_account.deploy.name
  role               = "roles/iam.workloadIdentityUser"
  members            = [local.github_repository_principal]

  depends_on = [google_iam_workload_identity_pool_provider.github]
}

resource "google_project_iam_member" "deploy_project_roles" {
  for_each = toset(var.deploy_project_roles)

  project = var.project_id
  role    = each.value
  member  = local.deploy_service_account_member
}

# Required for gcloud builds submit from GitHub Actions.
resource "google_project_iam_member" "pingcap_gh_deploy_service_usage_consumer" {
  project = "gcp-digital-bi"
  role    = "roles/serviceusage.serviceUsageConsumer"
  member  = "serviceAccount:pingcap-gh-deploy@gcp-digital-bi.iam.gserviceaccount.com"
}

resource "google_service_account_iam_member" "deploy_can_act_as_runtime" {
  service_account_id = "projects/${var.project_id}/serviceAccounts/${var.runtime_service_account_email}"
  role               = "roles/iam.serviceAccountUser"
  member             = local.deploy_service_account_member
}

resource "google_artifact_registry_repository_iam_member" "cloud_build_artifact_registry_writer" {
  project    = var.project_id
  location   = var.artifact_registry_location
  repository = var.artifact_registry_repository
  role       = "roles/artifactregistry.writer"
  member     = "serviceAccount:${var.cloud_build_service_account_email}"
}

# Required because gcloud uploads source to the default Cloud Build staging bucket.
resource "google_storage_bucket_iam_member" "pingcap_gh_deploy_cloudbuild_bucket_object_admin" {
  bucket = "gcp-digital-bi_cloudbuild"
  role   = "roles/storage.objectAdmin"
  member = "serviceAccount:pingcap-gh-deploy@gcp-digital-bi.iam.gserviceaccount.com"
}