') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); fix(0-bootstrap): take the organization id explicitly in import.sh by scottonix · Pull Request #215 · google/stellar-engine · GitHub
Skip to content

fix(0-bootstrap): take the organization id explicitly in import.sh - #215

Open
scottonix wants to merge 1 commit into
google:mainfrom
scottonix:fix/0-bootstrap-import-org-id
Open

fix(0-bootstrap): take the organization id explicitly in import.sh#215
scottonix wants to merge 1 commit into
google:mainfrom
scottonix:fix/0-bootstrap-import-org-id

Conversation

@scottonix

@scottonixscottonix commented Aug 28, 2026

Copy link
Copy Markdown

Description

fast/stages-aw/0-bootstrap/import.sh assigns the organization from gcloud organizations list --format='value(ID)', which prints one line per organization the caller can see. For any deployer with access to more than one organization — a consultancy account, a shared automation identity — ORG becomes a multi-line string that is spliced into every policy resource name, and the generated imports.tf references organizations that do not exist.

import.sh now takes the organization id as its first argument or from ORGANIZATION_ID, and only falls back to gcloud organizations list when exactly one organization is visible; with several it exits with a message naming them instead of generating bad imports. scripts/deploy.sh passes ${ORGANIZATION_ID}, exactly as it already does for setIAM.sh and enableServices.sh.

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update

Deployment & Compliance Impact

  • Applicable Regimes:
    • US Region Restricted (e.g., Access Policy constraint)
    • FedRAMP Moderate
    • FedRAMP High
    • DoD IL4
    • DoD IL5
    • General / All
  • NIST 800-53r5 Controls: none affected (the script only generates import blocks for the org policies the stage already manages).

Checklist

Code Quality & Reusability

  • My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
  • I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
  • My code follows the established naming conventions outlined in documentation/naming-convention.md.

Documentation

  • I have updated the README.md of the modified module or blueprint. (The README does not describe import.sh's inputs; the comment in the script now does.)
  • I have added/updated documentation for inputs (variables) and outputs.

Security

  • My change adheres to GCP security best practices and the principle of least privilege.
  • I have ensured compliance with the targeted regime (FedRAMP Moderate, FedRAMP High, IL5, etc.).

Testing

  • I have tested my changes locally.
  • I have included details of my testing in this PR.

Testing Performed

  • bash -n and shellcheck (all severities) on import.sh: clean, before and after.

  • The organization-selection block was exercised against a stub gcloud on PATH:

    caseresult
    first argument givenORG = the argument, gcloud not consulted
    ORGANIZATION_ID set, no argumentORG = the variable
    neither, one organization visibleORG = that organization
    neither, two organizations visibleexits 1: more than one organization is visible (111 222). Pass the organization ID as the first argument or set ORGANIZATION_ID.
    neither, none visibleexits 1: Failed to get organization ID. (unchanged message)

  • Observed originally on a deployment whose deployer could see two organizations: the previous script produced a two-line ORG and an imports.tf with malformed ids.

@scottonix
fix(0-bootstrap): take the organization id explicitly in import.sh
e9a77d1
import.sh assigned ORG from 'gcloud organizations list', which returns one line
per organization the caller can see. Any deployer with access to more than one
organization (a consultancy account, a shared service account) got a multi-line
value spliced into every policy resource name, and the generated imports.tf
referenced organizations that do not exist.
import.sh now takes the organization id as its first argument or from
ORGANIZATION_ID, and only falls back to gcloud when exactly one organization
is visible; with several it fails with a message naming them instead of
generating bad imports. deploy.sh passes ORGANIZATION_ID, as it already does
for setIAM.sh and enableServices.sh.
Signed-off-by: Scott McDonald <scott.mcdonald@onixnet.com>
@aghassemloueiaghassemlouei added bug Something isn't working Priority - Medium Standard features and non-blocking bugs; important for the current milestone but not urgent Level of Effort - Low Quick, well-defined tasks with no unknowns; takes a few hours up to one day to complete labels Aug 28, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bugSomething isn't workingLevel of Effort - LowQuick, well-defined tasks with no unknowns; takes a few hours up to one day to completePriority - MediumStandard features and non-blocking bugs; important for the current milestone but not urgent

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@scottonix@aghassemlouei