feat(gcp)!: withdraw DiskAsyncReplication until the agent can resolve a reference at plan time

.github/workflows/debug-conformance.yml

@@ -23,6 +23,11 @@ on:
         required: false
         default: true
         type: boolean
+      formae_branch:
+        description: "Build formae from this branch instead of using the released binary (e.g. main) - use it to reproduce a nightly-only failure"
+        required: false
+        default: ""
+        type: string
 
 # Share the serialization group with ci.yml and nightly.yml so runs never race
 # for the same GCP test project. A debug invocation queues behind an in-flight
@@ -117,6 +122,38 @@ jobs:
           workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
           service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
 
+      # Without this the run uses the released formae the SDK installs, which is
+      # the wrong binary for reproducing a nightly failure: the nightly validates
+      # plugin main against formae main, so an agent-side change that has not been
+      # released yet is only visible here. Mirrors the nightly's build step.
+      - name: Build formae from branch
+        if: inputs.formae_branch != ''
+        run: |
+          BRANCH="${{ inputs.formae_branch }}"
+          git clone --branch "${BRANCH}" --depth 1 https://github.com/platform-engineering-labs/formae.git /tmp/formae
+          cd /tmp/formae
+          git fetch --tags
+          # The baked VERSION becomes FORMAE_VERSION for plugins, which resolve
+          # their formae PKL dep against a published schema of that version, so
+          # it has to be a released X.Y.Z - the latest tag with any -dev.N
+          # suffix stripped, exactly as the nightly picks it.
+          LATEST_TAG=$(git tag -l "[0-9]*" --sort=-version:refname | head -1)
+          VERSION=$(echo "$LATEST_TAG" | cut -d'-' -f1)
+          echo "Building formae ${BRANCH} ($(git rev-parse --short HEAD)) with VERSION=${VERSION}"
+          make build VERSION="${VERSION}"
+          echo "FORMAE_BINARY=/tmp/formae/formae" >> $GITHUB_ENV
+
+      - name: Inject formae replace directives
+        if: inputs.formae_branch != ''
+        run: |
+          for pkg in pkg/auth pkg/model pkg/plugin pkg/plugin-conformance-tests; do
+            if grep -q "formae/$pkg" go.mod 2>/dev/null; then
+              echo "Injecting replace for $pkg -> /tmp/formae/$pkg"
+              go mod edit -replace "github.com/platform-engineering-labs/formae/$pkg=/tmp/formae/$pkg"
+            fi
+          done
+          go mod tidy
+
       - name: Install plugin
         run: make install
 

CHANGELOG.md

@@ -10,14 +10,20 @@ formae agent.
 
 ## [Unreleased]
 
-### Fixed
-
-- A `GCP::Compute::DiskAsyncReplication` no longer plans a replacement of itself.
-  Its two disk references are createOnly, and an extracted forma writes a
-  reference to another resource unresolved, so comparing it against the URL
-  already in state read as a change to an immutable field. Which disks a pair
-  joins is fixed at creation and is what its native ID is made of, so the two
-  fields are now write-only - excluded from drift detection, unchanged on create.
+### Removed
+
+- `GCP::Compute::DiskAsyncReplication` is withdrawn. It never shipped in a stable
+  release, only in 0.1.13-dev.1 and -dev.2. Its two properties are the disks the
+  pair joins: both immutable, and both declared as references to the disk
+  resources, which is how a forma names them. An extracted forma writes such a
+  reference unresolved, so the re-apply compares a reference against the URL in
+  state on an immutable path and plans a replacement of the pair already in
+  place. Suppressing that comparison fixes the lifecycle and makes the pair
+  undiscoverable, because the agent requires both fields on a resource it
+  persists; reporting them keeps discovery and brings the replacement back. No
+  plugin-side shape satisfies both, so the type is out until the agent can
+  resolve a reference at plan time. The work, the four conformance runs behind
+  that conclusion, and the two agent-side asks are in the draft PR.
 
 ### Fixed
 

README.md

@@ -46,7 +46,6 @@ This plugin supports **154 GCP resource types** across 32 services. See
 | `GCP::Compute::BackendService` | Global backend service for load balancers |
 | `GCP::Compute::BackendServiceSignedUrlKey` | Cloud CDN signed-URL key on a backend service |
 | `GCP::Compute::Disk` | Persistent disk |
-| `GCP::Compute::DiskAsyncReplication` | Replication link between a primary disk and a secondary disk in another region |
 | `GCP::Compute::DiskResourcePolicyAttachment` | Attaches a `resourcePolicy` to a disk |
 | `GCP::Compute::ExternalVpnGateway` | Describes the *other* end of a VPN: the on-prem or other-cloud device, by its public IP(s) |
 | `GCP::Compute::Firewall` | VPC firewall rule |