Add support for more services to github-ci-bootstrap (#18)

## Summary:
This adds support for a few new services that are used by github-actions-runners deployments.

Issue: INFRA-10749

## Test plan:
Update github-actions-runners to use this, apply the changes, and test with PR checks.

Author: jwbron

Reviewers: csilvers

Required Reviewers:

Approved By: csilvers

Checks: ✅ 2 checks were successful

Pull Request URL: #18

Author: jwbron

terraform/modules/github-ci-bootstrap/main.tf

@@ -15,22 +15,30 @@ terraform {
 # Define service-to-role mapping
 locals {
   read_write_roles = {
-    cloudfunctions = "roles/cloudfunctions.admin"
-    storage        = "roles/storage.admin"
-    pubsub         = "roles/pubsub.admin"
-    scheduler      = "roles/cloudscheduler.admin"
-    run            = "roles/run.admin"
-    cloudbuild     = "roles/cloudbuild.builds.builder"
+    cloudfunctions     = "roles/cloudfunctions.admin"
+    storage            = "roles/storage.admin"
+    pubsub             = "roles/pubsub.admin"
+    scheduler          = "roles/cloudscheduler.admin"
+    run                = "roles/run.admin"
+    cloudbuild         = "roles/cloudbuild.admin"
+    artifactregistry   = "roles/artifactregistry.admin"
+    secretmanager      = "roles/secretmanager.admin"
+    logging            = "roles/logging.admin"
+    monitoring         = "roles/monitoring.admin"
   }
 
   # Read-only roles for any branch
   read_only_roles = {
-    cloudfunctions = "roles/cloudfunctions.viewer"
-    storage        = "roles/storage.objectViewer"
-    pubsub         = "roles/pubsub.viewer"
-    scheduler      = "roles/cloudscheduler.viewer"
-    run            = "roles/run.viewer"
-    cloudbuild     = "roles/cloudbuild.builds.builder" # Read-only branches still need build access
+    cloudfunctions     = "roles/cloudfunctions.viewer"
+    storage            = "roles/storage.objectViewer"
+    pubsub             = "roles/pubsub.viewer"
+    scheduler          = "roles/cloudscheduler.viewer"
+    run                = "roles/run.viewer"
+    cloudbuild         = "roles/cloudbuild.viewer" # Read-only branches get viewer access
+    artifactregistry   = "roles/artifactregistry.reader"
+    secretmanager      = "roles/secretmanager.viewer"
+    logging            = "roles/logging.viewer"
+    monitoring         = "roles/monitoring.viewer"
   }
 
   # Parse GitHub repository into org and repo name

terraform/modules/github-ci-bootstrap/variables.tf

@@ -33,11 +33,15 @@ variable "target_projects" {
           "pubsub",
           "scheduler",
           "run",
-          "cloudbuild"
+          "cloudbuild",
+          "artifactregistry",
+          "secretmanager",
+          "logging",
+          "monitoring"
         ], service)
       ]
     ]))
-    error_message = "Required services must be one of: cloudfunctions, storage, pubsub, scheduler, run, cloudbuild."
+    error_message = "Required services must be one of: cloudfunctions, storage, pubsub, scheduler, run, cloudbuild, artifactregistry, secretmanager, logging, monitoring."
   }
 }