A+B 複合 — Pydantic v2 BaseSettings（Ch2/Ch3/Ch10）× GitHub Actions OIDC + WIF + Cloud Run v2 キーレスデプロイ

📋 コピー# ケース1: 正常系（全フィールド設定済み）
import os
os.environ.update({
    "GCP_PROJECT_ID": "my-ec-production",
    "BATCH_SIZE": "500",
    "ENV": "production",
    "SLACK_WEBHOOK_URL": "https://hooks.slack.com/services/xxx/yyy/zzz",
})

cfg = get_config()
print(cfg.gcp_project_id)  # "my-ec-production"
print(cfg.batch_size)      # 500  ← int 型に自動変換
print(cfg.env)             # "production"

# ケース2: 必須フィールド GCP_PROJECT_ID 未設定
del os.environ["GCP_PROJECT_ID"]
get_config()
# → pydantic_core.ValidationError: 1 validation error for AppConfig
#   gcp_project_id
#     Field required [type=missing, input_url=...]

# ケース3: BATCH_SIZE が範囲外
os.environ["GCP_PROJECT_ID"] = "proj"
os.environ["BATCH_SIZE"] = "99999"
get_config()
# → ValidationError: batch_size
#     Input should be less than or equal to 10000 [type=less_than_equal]

# ケース4: ENV タイポ
os.environ["BATCH_SIZE"] = "100"
os.environ["ENV"] = "prodution"  # タイポ
get_config()
# → ValidationError: env
#     Input should be 'staging' or 'production' [type=literal_error]

# ケース5: 不正 Webhook URL
os.environ["ENV"] = "staging"
os.environ["SLACK_WEBHOOK_URL"] = "http://example.com/hook"
get_config()
# → ValidationError: slack_webhook_url
#     SLACK_WEBHOOK_URL は 'https://hooks.slack.com/' で始まる必要があります

# ケース6: production で Webhook 未設定（クロスフィールドバリデーション）
os.environ.pop("SLACK_WEBHOOK_URL", None)
os.environ["ENV"] = "production"
get_config()
# → ValidationError: AppConfig
#     production 環境では SLACK_WEBHOOK_URL が必須です

📋 コピー# terraform/modules/github-actions-wif/main.tf
# GitHub Actions OIDC → Cloud Run v2 デプロイのキーレス認証基盤

# ── Workload Identity Pool ────────────────────────────────────────────────
resource "google_iam_workload_identity_pool" "github_actions" {
  project                   = var.project_id
  workload_identity_pool_id = "github-actions-pool"
  display_name              = "GitHub Actions WIF Pool"
  description               = "GitHub Actions OIDC 用 Workload Identity Pool"
}

# ── OIDC プロバイダー（GitHub の issuer_uri を信頼）─────────────────────────
resource "google_iam_workload_identity_pool_provider" "github_oidc" {
  project                            = var.project_id
  workload_identity_pool_id          = google_iam_workload_identity_pool.github_actions.workload_identity_pool_id
  workload_identity_pool_provider_id = "github-oidc-provider"
  display_name                       = "GitHub OIDC Provider"

  oidc {
    # GitHub の OIDC issuer（固定値）
    issuer_uri = "https://token.actions.githubusercontent.com"
  }

  # GitHub JWT クレーム → GCP attribute のマッピング
  attribute_mapping = {
    "google.subject"       = "assertion.sub"         # repo:org/repo:ref:refs/heads/main
    "attribute.repository" = "assertion.repository"  # "my-org/order-service"
    "attribute.ref"        = "assertion.ref"          # "refs/heads/main"
    "attribute.actor"      = "assertion.actor"        # GitHub ユーザー名（監査ログ用）
  }

  # セキュリティ境界: 特定リポジトリからのリクエストのみ許可
  # フォークリポジトリからのデプロイを防ぐ
  attribute_condition = "attribute.repository == 'my-org/order-service'"
}

# ── デプロイ用 Google Service Account（最小権限）────────────────────────────
resource "google_service_account" "deploy_sa" {
  project      = var.project_id
  account_id   = "cloudrun-deploy-sa"
  display_name = "Cloud Run デプロイ SA（GitHub Actions 専用）"
  description  = "GitHub Actions OIDC 経由でのみ権限借用可能。SA キーなし。"
}

# Cloud Run v2 デプロイ権限（最小: deploy のみ、delete や IAM 管理は不可）
resource "google_project_iam_member" "deploy_run_developer" {
  project = var.project_id
  role    = "roles/run.developer"
  member  = "serviceAccount:${google_service_account.deploy_sa.email}"
}

# Artifact Registry へのイメージ Push 権限（roles/editor より遥かに狭い）
resource "google_project_iam_member" "deploy_ar_writer" {
  project = var.project_id
  role    = "roles/artifactregistry.writer"
  member  = "serviceAccount:${google_service_account.deploy_sa.email}"
}

# ── WIF バインディング: 特定リポジトリのみが SA を借用可能 ─────────────────
# principalSet で「my-org/order-service リポジトリからのリクエスト全て」を対象
resource "google_service_account_iam_member" "github_wif_binding" {
  service_account_id = google_service_account.deploy_sa.name
  role               = "roles/iam.workloadIdentityUser"

  # principalSet: Pool 内の特定 attribute を持つ identity の集合
  member = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github_actions.name}/attribute.repository/my-org/order-service"
}

# ── Cloud Run v2 IAM（認証あり: allUsers 廃止）──────────────────────────────
# 呼び出し元（ここではデプロイ SA + 他の承認 SA）のみに invoker を付与
resource "google_cloud_run_v2_service_iam_member" "invoker" {
  project  = var.project_id
  location = var.region
  name     = "order-event-api"
  role     = "roles/run.invoker"

  # デプロイ SA を invoker に追加（ヘルスチェック等のために必要）
  member = "serviceAccount:${google_service_account.deploy_sa.email}"
}

📋 コピー# terraform/modules/github-actions-wif/outputs.tf
output "workload_identity_provider" {
  description = "GitHub Actions ワークフローの workload_identity_provider 入力値"
  value       = google_iam_workload_identity_pool_provider.github_oidc.name
  # 例: projects/123456789/locations/global/workloadIdentityPools/github-actions-pool/providers/github-oidc-provider
}

output "deploy_service_account_email" {
  description = "GitHub Actions が借用するデプロイ用 SA のメールアドレス"
  value       = google_service_account.deploy_sa.email
}