noisypigeon.garden

scaleway/job-definition v0.1.0

By noisypigeon.garden

This implements LIB-0053 (noisypigeon/runway#191). runway doesn't use it yet: that comes after the release.

The new module, tools/terraform/scaleway/job-definition (scaleway ~> 2.89):

  • It wraps scaleway_job_definition. Inputs are named for the entry keys: image (pinned tag or digest, validated), command, args, cpu, memory, storage, timeout, schedule, timezone and env.
  • schedule becomes the definition's cron, so Scaleway starts the runs. Without it the job is ad hoc.
  • secret_env and secret_wiring become one scaleway_secret and version each, and reach the run as environment variables through secret_reference, never as plain env.
  • Outputs are id, name and recurring. The README carries the docs markers that module-docs.yml fills on main.

The kind, scaleway.job.<k>, in root.hcl and its twin resolve-workloads.sh:

  • env values come in three forms:
    • plain values, which go to env;
    • {secretRef: NAME} from secrets.workload.yaml, which goes to secret_env;
    • {apiKey: <key>, field: access_key|secret_key}, which goes to secret_wiring. The stub fills it from that scaleway.iam.apiKey leaf, as an instance's keyring is wired.
  • job-runner: any job implies a job-runner application, a policy granting ServerlessJobsFullAccess on the workload's project only, and a key, all signed in with the spoke's key. job-runner is reserved.
  • Validation:
    • a pinned image;
    • kebab-case names;
    • project_id can't be set;
    • each env value must be a value, a secretRef or a known apiKey with a valid field;
    • a missing secretRef is refused in root.hcl.

Ad-hoc runs, tools/github/workflows/scaleway-job-run.yml:

  • Inputs: unit_dir, job, and optional args (JSON array) and env (JSON object).
  • It reads the job's ID and the job-runner key from state, as site-r2.yml does.
  • It starts one run through the Serverless Jobs v1alpha2 API, then polls until succeeded, failed or interrupted.
  • The request and run-state shapes are taken from Scaleway's Go SDK.

Garden lists the module, so its inputs.schema.json is generated on release.

How I checked it:

  • Two new generator tests:
    • a job with apiKey env generates its definition stub, the apikey_reader dependency, both secret_wiring entries, and the three job-runner leaves;
    • an unpinned image and a declared job-runner key are refused.
  • The script tests pass, apart from the two check-policies cases that also fail on main in this sandbox.
  • runway's own stubs are unchanged.
  • root.hcl parses.
  • The module passes terraform fmt. terraform validate couldn't run here because the provider registry is unreachable, so the schema was checked against the provider's docs at v2.89.0.

Release: release:minor. That releases github/terragrunt and github/workflows, and starts the new track terraform/scaleway/job-definition at v0.1.0. Nothing plans here.

Generated by Claude Code

PR: https://github.com/noisypigeon/runway/pull/192