feat(agent): Gemini/Anthropic を Vertex AI（SA→ADC）経由に移行（ADR-0015） - #401
Merged
Conversation
職務経歴書（PII）の学習リスク回避のため Gemini Developer API 無料枠を廃し、 Gemini と Anthropic を Vertex AI（Cloud Run の SA → ADC）経由に切り替える。 OpenAI のみ GCP に存在しないため API キーを継続する。 - google_client: genai.Client(vertexai=True, project, location) 化 - anthropic_client: AsyncAnthropicVertex(project_id, region) 化（generate は無変更） - model_catalog: Haiku を Vertex 版 ID（claude-haiku-4-5@20251001）に （Sonnet 4.6 / Gemini は同 ID） - settings/env_keys: API キー getter を GCP_PROJECT_ID + VERTEX_LOCATION / VERTEX_ANTHROPIC_LOCATION に置換（Gemini=Tokyo / Claude=Singapore） - requirements: anthropic[vertex]（ADC 用 google-auth） - infra(cloud_run): ANTHROPIC_API_KEY/GOOGLE_API_KEY 注入停止・Vertex location 注入追加 （secret コンテナ削除は別 PR） - docker-compose / docs/api.md 更新・ADR-0015 起票 - tests: key 未設定→project 未設定に置換、billing の Haiku model_id assert を更新 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughMigrates Gemini and Anthropic LLM clients to Vertex AI using GCP project and region configuration, updates related docs, tests, and runtime wiring, versions the Haiku model ID, and refreshes Terraform provider locks plus Cloudflare resource naming. ChangesVertex AI Migration
Infrastructure Maintenance
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docker-compose.yml`:
- Around line 42-43: The VERTEX_LOCATION and VERTEX_ANTHROPIC_LOCATION
environment variables in docker-compose.yml are using bare variable substitution
syntax without default values, which causes unset variables to become empty
strings instead of allowing the backend to apply its own fallback defaults.
Modify both variable references to include default values using the Docker
Compose syntax of ${VARIABLE_NAME:-default_value}, ensuring that when these
environment variables are not set, appropriate default values are used instead
of empty strings to prevent Vertex clients from being initialized with blank
locations.
In `@infra/modules/cloud_run/main.tf`:
- Around line 12-16: The deprecated `anthropic-api-key` and `google-api-key`
entries are still present in `local.secret_names`, which causes unnecessary IAM
permissions to be granted to the Cloud Run service account even though these
secrets are no longer used after the Vertex AI migration. Remove both the
`anthropic-api-key` and `google-api-key` strings from the `local.secret_names`
list to follow least privilege IAM principles and ensure the Cloud Run service
account only has access to the secrets it actually needs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: e7aec2cd-6897-4d2b-ae41-b8e4c8f49a52
📒 Files selected for processing (14)
backend/app/core/env_keys.pybackend/app/core/settings.pybackend/app/services/agent/llm/anthropic_client.pybackend/app/services/agent/llm/base.pybackend/app/services/agent/llm/google_client.pybackend/app/services/agent/model_catalog.pybackend/requirements.txtbackend/tests/test_billing.pybackend/tests/test_llm_clients.pydocker-compose.ymldocs/adr/0015-vertex-ai-for-gemini-anthropic.mddocs/api.mdinfra/modules/cloud_run/main.tfinfra/modules/cloud_run/variables.tf
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
versions.tf が cloudflare ~> 5.0 を要求しているのに lock が v4 系（4.52.7）を pin したままで、infra を触る PR の opentofu-validate が provider 解決段階で 失敗していた（main 由来の既存ドリフト。本 PR が初の infra 変更で顕在化）。 - cloudflare provider を v5.21.0 に更新（turso 1.2.0 / google 7.37.0 も追従） - cloudflare_record → cloudflare_dns_record（v5 改名）、value → content、 ttl=1 を明示（v5 で必須）。use_custom_domain は全環境 false で count=0 の ため移行対象インスタンスは無く moved ブロックは不要 - dev/stg/prod の lock を linux_amd64 + darwin_arm64 の両プラットフォームで再生成 make infra-validate（3 環境）/ infra-fmt-check 済み。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- docker-compose: VERTEX_LOCATION / VERTEX_ANTHROPIC_LOCATION に :-既定値 を付与。
bare の ${VAR} は未設定時に空文字を注入し backend の os.getenv フォールバックを
潰すため（Vertex client が空ロケーションで初期化される）
- cloud_run: Vertex 移行で未使用になった anthropic-api-key / google-api-key を
secret_names から削除（コンテナと secretAccessor を destroy / least privilege）。
本 PR で注入廃止と同時に削除する方針に変更（当初の別 PR 分離を取りやめ）
make infra-validate（3 環境）/ infra-fmt-check 済み。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>yusuke0610
commented
Jun 23, 2026
OwnerAuthor
@coderabbitai RVして |
✅ Action performedFull review finished. |
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/adr/0015-vertex-ai-for-gemini-anthropic.md`:
- Line 47: The ADR statement at line 47 describing the deprecated secret
retention strategy is inconsistent with the current infrastructure
implementation in infra/modules/cloud_run/main.tf, which already removes
anthropic-api-key and google-api-key from the secret_names list. Update the ADR
documentation to reflect the actual current state where these secrets are
already being excluded and will be deleted on the next terraform apply, rather
than stating they will be retained for deletion in a separate PR.
In `@infra/modules/cloud_run/variables.tf`:
- Around line 67-77: Add validation blocks to both the vertex_location and
vertex_anthropic_location variables to ensure they only accept non-empty string
values. Use a Terraform validation condition that checks the string length is
greater than zero, with an error message indicating that these variables cannot
be empty, as empty values would prevent proper Vertex AI client initialization
in Cloud Run.
In `@infra/modules/cloudflare/main.tf`:
- Around line 19-29: Add a moved block to the infra/modules/cloudflare/main.tf
file to handle the resource migration from cloudflare_record.app to
cloudflare_dns_record.app. The moved block should map the old resource state
(cloudflare_record.app) to the new resource type (cloudflare_dns_record.app) to
prevent Terraform from destroying and recreating the DNS record during the
upgrade to Cloudflare provider v5. Place this moved block in the same file where
the cloudflare_dns_record.app resource is defined.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2956ce6c-ea41-41c8-ac80-792f0dae66ea
📒 Files selected for processing (19)
AGENTS.mdbackend/app/core/env_keys.pybackend/app/core/settings.pybackend/app/services/agent/llm/anthropic_client.pybackend/app/services/agent/llm/base.pybackend/app/services/agent/llm/google_client.pybackend/app/services/agent/model_catalog.pybackend/requirements.txtbackend/tests/test_billing.pybackend/tests/test_llm_clients.pydocker-compose.ymldocs/adr/0015-vertex-ai-for-gemini-anthropic.mddocs/api.mdinfra/environments/dev/.terraform.lock.hclinfra/environments/prod/.terraform.lock.hclinfra/environments/stg/.terraform.lock.hclinfra/modules/cloud_run/main.tfinfra/modules/cloud_run/variables.tfinfra/modules/cloudflare/main.tf
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
- cloudflare: cloudflare_record → cloudflare_dns_record の改名に moved block を追加。 全環境 use_custom_domain=false（count=0）で現状インスタンスは無いが、有効化済み state での destroy/recreate（DNS ダウンタイム）を防ぐ防御策 - cloud_run: vertex_location / vertex_anthropic_location に空文字を弾く validation を追加 （空文字注入で backend のデフォルト補完が潰れるのを防ぐ） - ADR-0015: 未使用シークレットを「残置（別PR削除）」→「本PRで削除」に記述を実装と整合 make infra-validate（3 環境）/ infra-fmt-check 済み。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
職務経歴書（PII）を扱う本番環境として、Gemini Developer API の無料枠（学習リスク）を廃止。Gemini と Anthropic を Vertex AI（Cloud Run の SA → ADC）に切り替え、シークレットを OpenAI キー 1 本に削減。
asia-northeast1（Tokyo）で Vertex 経由にasia-southeast1（Singapore）で Vertex 経由に（Tokyo 未提供のため最寄り）技術変更
google_client.py:genai.Client(vertexai=True, project, location)化anthropic_client.py:AsyncAnthropicVertex(project_id, region)化model_catalog.py: Haiku を Vertex 版 ID（claude-haiku-4-5@20251001）に統一ANTHROPIC_API_KEY/GOOGLE_API_KEY廃止、VERTEX_LOCATION/VERTEX_ANTHROPIC_LOCATION追加requirements.txt:anthropic[vertex]で ADC 対応検証
make ci(lint + test): pass ✅トレードオフ
LLM_LOCAL_OLLAMA=1で Vertex を避ける（ADC 不要）。実 Vertex をローカルで試す場合のみgcloud auth application-default login関連
🤖 Generated with Claude Code
Summary by CodeRabbit
ANTHROPIC_API_KEY/GOOGLE_API_KEY; addedVERTEX_LOCATIONandVERTEX_ANTHROPIC_LOCATION(with defaults).