diff --git a/gcp/workload-identity-federation-direct.tf b/gcp/workload-identity-federation-direct.tf index c3ccbe2..9864557 100644 --- a/gcp/workload-identity-federation-direct.tf +++ b/gcp/workload-identity-federation-direct.tf @@ -34,7 +34,7 @@ resource "google_iam_workload_identity_pool_provider" "github_provider" { workload_identity_pool_provider_id = "ambient-code-github-actions" display_name = "ambient-code GitHub Actions" - attribute_condition = "assertion.repository in ['ambient-code/platform', 'ambient-code/opentofu']" + attribute_condition = "assertion.repository in ['ambient-code/platform', 'ambient-code/opentofu', 'ambient-code/pull-reviews']" attribute_mapping = { "google.subject" = "assertion.sub" @@ -57,6 +57,14 @@ resource "google_project_iam_member" "github_vertex_ai_access" { member = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github_pool.name}/attribute.repository/ambient-code/platform" } +# Grant Vertex AI User role to the ambient-code/pull-reviews repository +# for AI-powered PR video review generation using Claude on Vertex. +resource "google_project_iam_member" "pull_reviews_vertex_ai_access" { + project = var.project_id + role = "roles/aiplatform.user" + member = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github_pool.name}/attribute.repository/ambient-code/pull-reviews" +} + # Outputs output "workload_identity_pool_id" { description = "The ID of the Workload Identity Pool"