fix: publish observed lifecycle after Cloud Run sync (#316)

Co-authored-by: Codex <noreply@openai.com>

Author: Pigbibi

.github/workflows/runtime-target-lifecycle.yml

@@ -2,6 +2,9 @@ name: Runtime Target Lifecycle
 
 on:
   workflow_dispatch:
+  workflow_run:
+    workflows: ["Deploy Cloud Run"]
+    types: [completed]
   schedule:
     - cron: "37 * * * *"
 
@@ -164,11 +167,16 @@ jobs:
 
       - name: Publish lifecycle to the unified control plane
         if: ${{ steps.lifecycle_ingress.outputs.enabled == 'true' }}
-        uses: QuantStrategyLab/QuantRuntimeSettings/actions/publish-runtime-target-lifecycle@1eb72e4be2c20f991be5e10153ae046ba0fde496
+        uses: QuantStrategyLab/QuantRuntimeSettings/actions/publish-runtime-target-lifecycle@c2e46314fd749fd40f4d5fbdbaedadc8b7b27dff
         with:
           source-id: firstrade.primary
           target-id: firstrade.primary
           platform: firstrade
+          observe-gcp: 'true'
+          gcp-project: ${{ env.GCP_PROJECT_ID }}
+          cloud-run-region: ${{ env.CLOUD_RUN_REGION }}
+          cloud-run-service: ${{ env.CLOUD_RUN_SERVICE }}
+          scheduler-location: ${{ env.RUNTIME_HEARTBEAT_SCHEDULER_LOCATION }}
           configured-state: ${{ steps.target_state.outputs.configured_state }}
           execution-mode: ${{ steps.target_state.outputs.execution_mode }}
           runtime-guard: ${{ steps.runtime_guard.outputs.status }}

tests/test_runtime_monitor_workflows.py

@@ -94,3 +94,34 @@ def test_runtime_guard_callers_use_locked_uv_runtime_before_authentication() ->
             "google-github-actions/auth@v3"
         )
     assert setup_python_lines == [f"        uses: {setup_python}"]
+
+
+def test_lifecycle_observes_completed_sync_regardless_of_conclusion() -> None:
+    workflow = (ROOT / ".github/workflows/runtime-target-lifecycle.yml").read_text()
+    sync = (ROOT / ".github/workflows/sync-cloud-run-env.yml").read_text()
+    sync_name = sync.splitlines()[0].removeprefix("name: ")
+
+    assert f'workflows: ["{sync_name}"]' in workflow
+    assert "types: [completed]" in workflow
+    assert "github.event.workflow_run.conclusion" not in workflow
+    assert "github.event.workflow_run.head_sha" not in workflow
+
+
+def test_lifecycle_publishes_read_only_observation_for_exact_service() -> None:
+    workflow = (ROOT / ".github/workflows/runtime-target-lifecycle.yml").read_text()
+    publisher = workflow.split("- name: Publish lifecycle to the unified control plane", 1)[1]
+    publisher = publisher.split("\n      - name:", 1)[0]
+
+    for line in (
+        "observe-gcp: 'true'",
+        "gcp-project: ${{ env.GCP_PROJECT_ID }}",
+        "cloud-run-region: ${{ env.CLOUD_RUN_REGION }}",
+        "cloud-run-service: ${{ env.CLOUD_RUN_SERVICE }}",
+        "scheduler-location: ${{ env.RUNTIME_HEARTBEAT_SCHEDULER_LOCATION }}",
+    ):
+        assert line in publisher
+    assert "CLOUD_RUN_SERVICE: ${{ secrets.CLOUD_RUN_SERVICE }}" in workflow
+    assert "RUNTIME_HEARTBEAT_SCHEDULER_LOCATION: ${{ vars.RUNTIME_HEARTBEAT_SCHEDULER_LOCATION || vars.CLOUD_RUN_REGION || 'us-central1' }}" in workflow
+    assert "CLOUD_RUN_SERVICES" not in publisher
+    assert "gcloud scheduler jobs update" not in workflow
+    assert "gcloud run deploy" not in workflow