applane-setup.sh flags

applane-setup.sh prepares a GCP project for Applane, or checks one. It is add-only, prints every command before running it, and deletes nothing. Works with bash 3.2 (the macOS default) and gcloud 400 or newer. How to use it: Script.

applane-setup.sh --project <GCP_PROJECT_ID> --group <BUILDERS_GROUP_EMAIL> [options]
applane-setup.sh --check   --project <GCP_PROJECT_ID> --group <BUILDERS_GROUP_EMAIL>

Flag	Required	Meaning
--project <id>	Yes	GCP project in your Workspace organisation.
--group <email>	Yes	Google Group that may build. Gets roles/aiplatform.user.
--budget-account <id>	No	Billing account XXXXXX-XXXXXX-XXXXXX. Creates a budget alert when set.
--budget-amount <n>	No	Monthly amount for the alert. Default 50, in the billing account’s currency; 50EUR style is also accepted.
--redirect-uri <uri>	No	The builder’s OAuth redirect URI. Printed, and probed when --client-id is given. Default: https://app.applane.dev/oauth/callback.
--client-id <id>	No	An OAuth client id you already created. The script asks Google whether it exists and accepts both redirect URIs, instead of printing the two console steps.
--dry-run	No	Print every command without running any.
--check	No	Verify instead of change: APIs, IAM, billing, and print the manual steps.
-h, --help	No	Usage.

What it does

1. gcloud config set project.
2. gcloud services enable for the five APIs. Already-enabled APIs are a no-op.
3. gcloud projects add-iam-policy-binding for roles/aiplatform.user to group:<BUILDERS_GROUP_EMAIL>.
4. With --budget-account: enable billingbudgets.googleapis.com and create a budget named applane-vertex-<GCP_PROJECT_ID> with alerts at 50%, 90% and 100%.
5. With --client-id: check that client against Google’s authorize endpoint, once per redirect URI. Without it, print the two console steps (consent screen, OAuth client) with the redirect URIs.

No gcloud command lists web OAuth clients, so the check calls https://accounts.google.com/o/oauth2/v2/auth and reads the answer: invalid_client means no client with that id, redirect_uri_mismatch means the client exists but that URI is not registered on it. It is a read; nobody signs in.

What --check prints

Line	Check
PASS API enabled: <api>	One per API. FAIL prints the enable command.
PASS IAM: roles/aiplatform.user -> group:<email>	The binding exists. FAIL prints the binding command.
PASS Billing linked to <project>	The project has a billing account.
INFO Apps Script API user setting	Per user; cannot be checked here. Apps Script API
PASS OAuth redirect URI: <uri>	With --client-id, one per URI. FAIL says whether the client or the URI is missing.
INFO OAuth consent screen and client	Without --client-id. The two console steps are printed instead.

Exit code is non-zero when any line is FAIL.

The console’s Test sign-in only exercises the console’s own redirect URI, so run this check to confirm the builder’s URI is registered too.

Permissions needed

serviceusage.services.enable and resourcemanager.projects.setIamPolicy on the project (owner or editor). roles/billing.costsManager on the billing account for the budget.