Feature cloudsql connector secured party

jobs/permanent/secured-party-notification/.gcloudignore

@@ -5,11 +5,7 @@ venv
 .env*
 .eggs
 Makefile
-devops
-k8s
 manage.py
 migrations
-pre-hook-update-db.sh
-requirements
 test_data
 tests

jobs/permanent/secured-party-notification/Dockerfile

@@ -32,11 +32,12 @@ ENV APP_ENV=${APP_ENV} \
   PIP_DEFAULT_TIMEOUT=100 \
   PIP_ROOT_USER_ACTION=ignore \
   # poetry:
-  POETRY_VERSION=1.8.3 \
+  POETRY_VERSION=2.1.3 \
   POETRY_NO_INTERACTION=1 \
   POETRY_VIRTUALENVS_CREATE=false \
   POETRY_CACHE_DIR='/var/cache/pypoetry' \
-  POETRY_HOME='/usr/local'
+  POETRY_HOME='/usr/local' \
+  POETRY_INSTALLER_PARALLEL=false
 
 SHELL ["/bin/bash", "-eo", "pipefail", "-c"]
 
@@ -67,18 +68,20 @@ COPY --chown=web:web ./poetry.lock ./pyproject.toml /code/
 
 COPY --chown=web:web ./src /code/src
 COPY --chown=web:web ./README.md /code
+COPY ./run.sh /opt/app-root/run.sh
 
 # Project initialization:
 RUN --mount=type=cache,target="$POETRY_CACHE_DIR" \
   echo "$APP_ENV" \
   && poetry version \
   # Install deps:
   && poetry run pip install -U pip \
-  && poetry install --only main --no-interaction --no-ansi
+  && poetry install --only main --no-interaction --no-ansi \
+  && chmod 755 /opt/app-root/run.sh
 
 USER web
 
 # Set Python path
 ENV PYTHONPATH=/code/src
 
-CMD [ "python", "-m", "secured_party_notification" ]
+CMD [ "/opt/app-root/run.sh" ]

jobs/permanent/secured-party-notification/devops/gcp/clouddeploy.yaml

@@ -0,0 +1,75 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+apiVersion: deploy.cloud.google.com/v1
+kind: DeliveryPipeline
+metadata:
+ name: ppr-secured-party-pipeline
+description: Deployment pipeline
+serialPipeline:
+ stages:
+ - targetId: eogruh-dev
+   profiles: [dev]
+   strategy:
+    standard:
+      verify: false
+   deployParameters:
+   - values:
+      deploy-env: "development"
+      deploy-project-id: "eogruh-dev"
+      job-name: "ppr-secured-party-dev"
+      run-command: "/opt/app-root/run.sh"
+      cloudsql-instances: "eogruh-dev:northamerica-northeast1:ppr-dev-cloudsql"
+      service-account: "sa-job@eogruh-dev.iam.gserviceaccount.com"
+ - targetId: eogruh-test
+   profiles: [test]
+   strategy:
+    standard:
+      verify: false
+   deployParameters:
+   - values:
+      deploy-env: "test"
+      deploy-project-id: "eogruh-test"
+      job-name: "ppr-secured-party-test"
+      run-command: "/opt/app-root/run.sh"
+      app-env: "test"
+      cloudsql-instances: "eogruh-test:northamerica-northeast1:ppr-test-cloudsql"
+      service-account: "sa-job@eogruh-test.iam.gserviceaccount.com"
+ - targetId: eogruh-sandbox
+   profiles: [sandbox]
+   strategy:
+    standard:
+      verify: false
+   deployParameters:
+   - values:
+      deploy-env: "sandbox"
+      deploy-project-id: "eogruh-sandbox"
+      job-name: "ppr-secured-party-sandbox"
+      run-command: "/opt/app-root/run.sh"
+      app-env: "sandbox"
+      cloudsql-instances: "eogruh-sandbox:northamerica-northeast1:ppr-sandbox-pgdb"
+      service-account: "sa-job@eogruh-sandbox.iam.gserviceaccount.com"
+ - targetId: eogruh-prod
+   profiles: [prod]
+   strategy:
+    standard:
+      verify: false
+   deployParameters:
+   - values:
+      deploy-env: "production"
+      deploy-project-id: "eogruh-prod"
+      job-name: "ppr-secured-party-prod"
+      run-command: "/opt/app-root/run.sh"
+      app-env: "production"
+      cloudsql-instances: "eogruh-prod:northamerica-northeast1:ppr-prod"
+      service-account: "sa-job@eogruh-prod.iam.gserviceaccount.com"

jobs/permanent/secured-party-notification/devops/vaults.gcp.env

@@ -0,0 +1,29 @@
+AUTH_API_URL="op://API/$APP_ENV/auth-api/AUTH_API_URL"
+AUTH_API_VERSION="op://API/$APP_ENV/auth-api/AUTH_API_VERSION"
+PAY_API_URL="op://API/$APP_ENV/pay-api/PAY_API_URL"
+PAY_API_VERSION="op://API/$APP_ENV/pay-api/PAY_API_VERSION"
+NOTIFY_API_URL="op://API/$APP_ENV/notify-api/NOTIFY_API_URL"
+NOTIFY_API_VERSION="op://API/$APP_ENV/notify-api/NOTIFY_API_VERSION"
+JWT_OIDC_WELL_KNOWN_CONFIG="op://keycloak/$APP_ENV/jwt-base/JWT_OIDC_WELL_KNOWN_CONFIG"
+JWT_OIDC_ISSUER="op://keycloak/$APP_ENV/jwt-base/JWT_OIDC_ISSUER"
+JWT_OIDC_JWKS_CACHE_TIMEOUT="op://keycloak/$APP_ENV/jwt-base/JWT_OIDC_JWKS_CACHE_TIMEOUT"
+JWT_OIDC_CACHING_ENABLED="op://keycloak/$APP_ENV/jwt-base/JWT_OIDC_CACHING_ENABLED"
+JWT_OIDC_ALGORITHMS="op://keycloak/$APP_ENV/jwt-base/JWT_OIDC_ALGORITHMS"
+JWT_OIDC_AUDIENCE="op://ppr/$APP_ENV/jwt/JWT_OIDC_AUDIENCE"
+JWT_OIDC_CLIENT_SECRET="op://ppr/$APP_ENV/jwt/JWT_OIDC_CLIENT_SECRET"
+JWT_OIDC_TOKEN_URL="op://ppr/$APP_ENV/jwt/JWT_OIDC_TOKEN_URL"
+ACCOUNT_SVC_CLIENT_ID="op://ppr/$APP_ENV/jwt/ACCOUNT_SVC_CLIENT_ID"
+ACCOUNT_SVC_CLIENT_SECRET="op://ppr/$APP_ENV/jwt/ACCOUNT_SVC_CLIENT_SECRET"
+DATABASE_NAME="op://database/$APP_ENV/ppr-db-gcp/DATABASE_NAME"
+DATABASE_USERNAME="op://database/$APP_ENV/ppr-db-gcp/JOB_DATABASE_USERNAME"
+CLOUDSQL_INSTANCE_CONNECTION_NAME="op://database/$APP_ENV/ppr-db-gcp/DATABASE_INSTANCE_CONNECTION_NAME"
+REPORT_API_URL="op://ppr/$APP_ENV/ppr-api/REPORT_SVC_URL"
+REPORT_API_AUDIENCE="op://ppr/$APP_ENV/ppr-api/REPORT_API_AUDIENCE"
+NOTIFY_STATUS_RECIPIENTS="op://ppr/$APP_ENV/secured-party/NOTIFY_STATUS_RECIPIENTS"
+NOTIFY_STATUS_SUBJECT="op://ppr/$APP_ENV/secured-party/NOTIFY_STATUS_SUBJECT"
+NOTIFY_STATUS_BODY="op://ppr/$APP_ENV/secured-party/NOTIFY_STATUS_BODY"
+JOB_INTERVAL_HOURS="op://ppr/$APP_ENV/secured-party/JOB_INTERVAL_HOURS"
+GOOGLE_DEFAULT_SA="op://buckets/$APP_ENV/ppr-api/GOOGLE_DEFAULT_SA"
+GCP_CS_SA_SCOPES="op://buckets/$APP_ENV/ppr-api/GCP_CS_SA_SCOPES"
+GCP_CS_BUCKET_ID_MAIL="op://buckets/$APP_ENV/ppr-api/GCP_CS_BUCKET_ID_MAIL"
+VPC_CONNECTOR="op://CD/$APP_ENV/ppr-secured-party/VPC_CONNECTOR"