use terraform to build

[kyokukou]

removes cloudbuild trigger
now use terraform via github actions to build image

[github-actions]

Terraform plan · production

Plan: 0 to add, 1 to change, 1 to destroy.

Show full plan

google_service_account.job: Refreshing state... [id=projects/arxiv-production/serviceAccounts/mod-notification-handler@arxiv-production.iam.gserviceaccount.com]
google_pubsub_topic.mod_notify: Refreshing state... [id=projects/arxiv-production/topics/mod-notify]
google_cloudbuild_trigger.deploy: Refreshing state... [id=projects/arxiv-production/locations/us-east1/triggers/62cf038d-dfab-483b-92eb-9e5744577517]
google_pubsub_subscription.mod_actions: Refreshing state... [id=projects/arxiv-production/subscriptions/mod-notification-handler]
google_project_iam_member.job["roles/secretmanager.secretAccessor"]: Refreshing state... [id=arxiv-production/roles/secretmanager.secretAccessor/serviceAccount:mod-notification-handler@arxiv-production.iam.gserviceaccount.com]
google_project_iam_member.job["roles/run.invoker"]: Refreshing state... [id=arxiv-production/roles/run.invoker/serviceAccount:mod-notification-handler@arxiv-production.iam.gserviceaccount.com]
google_project_iam_member.job["roles/pubsub.subscriber"]: Refreshing state... [id=arxiv-production/roles/pubsub.subscriber/serviceAccount:mod-notification-handler@arxiv-production.iam.gserviceaccount.com]
google_project_iam_member.job["roles/cloudsql.client"]: Refreshing state... [id=arxiv-production/roles/cloudsql.client/serviceAccount:mod-notification-handler@arxiv-production.iam.gserviceaccount.com]
google_cloud_run_v2_job.jobs["mod_actions"]: Refreshing state... [id=projects/arxiv-production/locations/us-central1/jobs/mod-notification-handler]
google_cloud_scheduler_job.jobs["mod_actions"]: Refreshing state... [id=projects/arxiv-production/locations/us-central1/jobs/mod-notification-handler-scheduler-trigger]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
  - destroy

Terraform will perform the following actions:

  # google_cloud_run_v2_job.jobs["mod_actions"] will be updated in-place
  ~ resource "google_cloud_run_v2_job" "jobs" {
        id                       = "projects/arxiv-production/locations/us-central1/jobs/mod-notification-handler"
        name                     = "mod-notification-handler"
        # (29 unchanged attributes hidden)

      ~ template {
            # (4 unchanged attributes hidden)

          ~ template {
                # (6 unchanged attributes hidden)

              ~ containers {
                  ~ args        = [
                      + "-m",
                      + "app.mod_actions.main",
                    ]
                  ~ command     = [
                      + "python",
                    ]
                    name        = "mod-notification-handler-1"
                    # (3 unchanged attributes hidden)

                    # (11 unchanged blocks hidden)
                }

                # (1 unchanged block hidden)
            }
        }
    }

  # google_cloudbuild_trigger.deploy will be destroyed
  # (because google_cloudbuild_trigger.deploy is not in configuration)
  - resource "google_cloudbuild_trigger" "deploy" {
      - create_time        = "2026-06-10T15:10:52.103357449Z" -> null
      - deletion_policy    = "DELETE" -> null
      - description        = "builds cloud run job that sends emails to mods" -> null
      - disabled           = false -> null
      - filename           = "cicd/cloudbuild.yaml" -> null
      - id                 = "projects/arxiv-production/locations/us-east1/triggers/62cf038d-dfab-483b-92eb-9e5744577517" -> null
      - ignored_files      = [] -> null
      - include_build_logs = "INCLUDE_BUILD_LOGS_WITH_STATUS" -> null
      - included_files     = [] -> null
      - location           = "us-east1" -> null
      - name               = "mod-notification-handler" -> null
      - project            = "arxiv-production" -> null
      - service_account    = "projects/arxiv-production/serviceAccounts/cloudbuild-sa@arxiv-production.iam.gserviceaccount.com" -> null
      - substitutions      = {
          - "_DEPLOY_REGION" = "us-central1"
          - "_JOB_NAME"      = "mod-notification-handler"
        } -> null
      - tags               = [
          - "mod-notify",
        ] -> null
      - trigger_id         = "62cf038d-dfab-483b-92eb-9e5744577517" -> null
        # (1 unchanged attribute hidden)

      - approval_config {
          - approval_required = false -> null
        }

      - github {
          - name                            = "mod-notification-handler" -> null
          - owner                           = "arXiv" -> null
            # (1 unchanged attribute hidden)

          - push {
              - branch       = "^main$" -> null
              - invert_regex = false -> null
                # (1 unchanged attribute hidden)
            }
        }
    }

Plan: 0 to add, 1 to change, 1 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.