feat(api): warehouse read API — games slice + gated deploy#86
Open
phenrickson wants to merge 11 commits into
Open
feat(api): warehouse read API — games slice + gated deploy#86phenrickson wants to merge 11 commits into
phenrickson wants to merge 11 commits into
Conversation
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Query SQL validated against real schemas via dry-run; a full game document scans ~360MB (serving tables unclustered) — clusterBy game_id follow-up tracked. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
/health plus games get-by-id and per-block sub-resources, over the games reader. Cloud Run IAM handles caller auth; app uses ADC for BigQuery. Tests mock the reader. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
IAM + ID-token gating with an invoker Google Group as the grant surface; extensible to the predictive-models services (all currently run.invoker: allUsers). Threads the decision into the games plan (Task 7 + security follow-up). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… front-end) Grant surface is the invoker group; day-one grant the owner's identity, not any front-end SA. API knows nothing about its consumers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Image builds from repo root via uv sync --extra api; verified locally (docker run -> /health 200). .dockerignore keeps credentials/.venv/.git out of the image. Deps come from the root pyproject api extra; no service-local pyproject. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…binding Task 7 reworked: compute deploy through a Cloud Build Actions workflow; run.invoker gating as an authoritative google_cloud_run_v2_service_iam_binding applied by terraform.yml (PR=plan, merge=apply). Two-merge ordering (service, then binding). No local gcloud/terraform. Auth-pattern spec updated to match. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Gated Cloud Run service (--no-allow-unauthenticated) built/deployed by config/cloudbuild.warehouse-api.yaml, triggered by deploy-warehouse-api.yml on push to main. Invoker gating lives in Terraform (separate PR). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…rface Access grants become a members-list edit -> PR -> apply via Actions (git-audited), instead of manual Google Group membership (which is outside Actions). Group demoted to an optional footnote. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
First slice of a warehouse read-API services layer: a gated FastAPI service
(
bgg-warehouse-api) serving a single game's full profile from the warehouse'smaterialized tables, so front-ends become pure HTTP consumers instead of reaching into
BigQuery directly.
What's included
config/bigquery.yaml— addpredictions+analyticsdatasetssrc/warehouse/bq.py— BigQuery client/dataset helpersrc/warehouse/readers/games.py—get_game(id)= features + predictions + embedding + similar + provenanceservices/warehouse_api/— FastAPI app,/health,gamesrouter (GET /games/{id}+ sub-resources)services/warehouse_api/Dockerfile+.dockerignoreconfig/cloudbuild.warehouse-api.yaml+.github/workflows/deploy-warehouse-api.ymldocs/superpowers/Verification
clusterBy game_idis a tracked follow-up)/health→ 200What merging does
Deploys a new, standalone, gated Cloud Run service (
--no-allow-unauthenticated),scales to zero, no callers yet. Does not touch the data pipeline, Dataform, or
BigQuery data (separate cloudbuild file; no pipeline trigger paths touched). No version
bump, so no release is cut.
Follow-ups (separate PRs)
run.invokerbinding. Merge after this PR (the service must exist first).clusterBy game_id, other resource routers, and gating the predictive-models services.🤖 Generated with Claude Code