applane-setup.sh flags

applane-setup.sh prepares a GCP project for Applane, or checks one. It is add-only, prints every command before running it, and deletes nothing. Works with bash 3.2 (the macOS default) and gcloud 400 or newer. How to use it: Script.

applane-setup.sh --project <GCP_PROJECT_ID> --group <BUILDERS_GROUP_EMAIL> [options]
applane-setup.sh --check   --project <GCP_PROJECT_ID> --group <BUILDERS_GROUP_EMAIL>

Flag	Required	Meaning
--project <id>	Yes	GCP project in your Workspace organisation.
--group <email>	Yes	Google Group that may build. Gets roles/aiplatform.user.
--budget-account <id>	No	Billing account XXXXXX-XXXXXX-XXXXXX. Creates a budget alert when set.
--budget-amount <n>	No	Monthly amount for the alert. Default 50, in the billing account’s currency; 50EUR style is also accepted.
--extension-id <id>	No	The Applane extension id from the console. Only used to print the redirect URIs. Default: the <APPLANE_EXTENSION_ID> placeholder.
--dry-run	No	Print every command without running any.
--check	No	Verify instead of change: APIs, IAM, billing, and print the manual steps.
-h, --help	No	Usage.

What it does

1. gcloud config set project.
2. gcloud services enable for the five APIs. Already-enabled APIs are a no-op.
3. gcloud projects add-iam-policy-binding for roles/aiplatform.user to group:<BUILDERS_GROUP_EMAIL>.
4. With --budget-account: enable billingbudgets.googleapis.com and create a budget named applane-vertex-<GCP_PROJECT_ID> with alerts at 50%, 90% and 100%.
5. Print the two console steps (consent screen, OAuth client) with the redirect URIs.

What --check prints

Line	Check
PASS API enabled: <api>	One per API. FAIL prints the enable command.
PASS IAM: roles/aiplatform.user -> group:<email>	The binding exists. FAIL prints the binding command.
PASS Billing linked to <project>	The project has a billing account.
INFO Apps Script API user setting	Per user; cannot be checked here. Apps Script API
INFO OAuth consent screen and client	Google has no API for it. The console’s checker tests it.

Exit code is non-zero when any line is FAIL.

Permissions needed

serviceusage.services.enable and resourcemanager.projects.setIamPolicy on the project (owner or editor). roles/billing.costsManager on the billing account for the budget.