add some basic policies and CI #2

	name: deploy
	on:
	push:
	branches: [main]
	workflow_dispatch:
	jobs:
	run:
	permissions:
	contents: read
	id-token: write
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

	- uses: hashicorp/setup-terraform@v3
	with:
	terraform_version: 1.5.7

	- name: lint
	run: terraform fmt */.tf

	- id: 'auth'
	uses: google-github-actions/auth@v2
	with:
	workload_identity_provider: ${{ secrets.GCLOUD_OIDC_POOL }}
	service_account: ${{ secrets.GSA }}
	token_format: 'access_token'

	- uses: google-github-actions/setup-gcloud@v2
	with:
	version: 'latest'

	- name: Configure gcloud
	run: \|
	gcloud config set project ${{ secrets.GCLOUD_PROJECT }}
	gcloud config set disable_prompts true

	- uses: 'docker/login-action@v3'
	name: 'Docker login'
	with:
	registry: 'us-docker.pkg.dev'
	username: 'oauth2accesstoken'
	password: '${{ steps.auth.outputs.access_token }}'

	- name: terraform apply
	run: ./ci/tf.sh
	env:
	TF_VAR_project: ${{ secrets.GCLOUD_PROJECT }}
	TF_VAR_region: ${{ secrets.GCLOUD_REGION }}

	- name: Upload logs as artifacts
	if: ${{ always() }}
	uses: actions/upload-artifact@v4
	with:
	name: terraform.log
	path: /tmp/terraform.log

	- name: cleanup
	if: ${{ always() }}
	run: rm /tmp/terraform.log

Provide feedback