GCP Infrastructure Overview¶

Introduction¶

WorkWingman runs on Google Cloud Platform (GCP) to deliver our job-search copilot web application. This document outlines how our cloud infrastructure works in non-technical terms.

Web Hosting¶

Cloud Run: We host our website using Google Cloud Run.
Safe Updates: When a new version of the website is prepared, it is held in a distinct ready state. Traffic is shifted only when ready, preventing partial or broken updates from reaching users.

Software Storage and Security Rules¶

Artifact Registry: Stores our software building blocks.
No Reusable Labels: We strictly forbid generic labels like "latest" or "v2". Every update uses a permanent, exact label (sha-<commit>). This guarantees that older software cannot accidentally run in place of new code.

Automated Builds¶

Cloud Build: An automated service builds our software directly from a verified, clean workplace before packaging.

Secret and Password Management¶

Secret Manager: Keeps sensitive keys and passwords safe.
Key Rotation Rule: Disabling an old password version does not automatically switch back to a previous working one. A new version must always be added first before turning off an old one to prevent system errors.

Content Storage¶

Google Cloud Storage: Holds website content files.
Integrity Checks: Digital signatures (SHA-256 ETags) confirm that content files are unchanged and authentic.

Configuration Safety¶

Environment Controls: App settings are declared through an environment ladder.
Preventing Lost Settings: Settings must be formally tracked so that routine software deployments do not erase active live configuration settings.

Access Control and Logs¶

User Permissions: TODO(verify) exact user access lists, service permissions, and project regions.
Audit Trails: System activity logs record who made changes and what commands were run, helping us investigate issues quickly.