Changes waiting for the first Azure/GCP deploy after the 2026-10-20 pause #1413

Azure and GCP deploys have been paused since 2026-10-20 (deploy-azure.yml, deploy-gcp.yml and deploy-all.yml are disabled). The owner released the merge hold the same day: "merging is allowed; Azure/GCP apply stays paused" (see #1114). So Azure/GCP PRs merge normally, but some of them change infrastructure that only applies on the first Azure/GCP deploy after the pause. This issue lists them, so that deploy isn't a surprise.

When a PR below merges, it gets ticked here with its merge commit. Whoever re-enables the deploys should read this list first and run a plan against each environment before applying.

Azure/GCP infrastructure that applies on the first deploy (open PRs, not merged yet):

• fix(iac/azure): schedule the server tasks on AKS with CronJobs #1114: schedule the server tasks on AKS with CronJobs
• fix(iac/azure): let the runtime identity write the admin-password secret, and log sync failures as errors #1309: runtime identity writes the admin-password secret (its Go logging part ships immediately on merge)
• fix(iac): require PostgreSQL 15+ in every environment's version input #1255: require PostgreSQL 15+ in every environment's version input
• fix(iac): bound every Terraform provider constraint below the next major #1203: bound every Terraform provider constraint below the next major
• chore(iac): derive the CFN issuer host, create the GCP signing key first, read the dev Function URL from state #1312: CFN issuer host, GCP signing key ordering (its AWS/CloudFormation parts are live on merge)
• sec(iac): narrow three hosted-infra least-privilege grants (GCP CI trust ref, rotation RDS ARN, Cloud Run compute reads) #1290: narrow three hosted-infra least-privilege grants. Also needs a manual GCP ci-cd-permissions apply.
• sec(ci): delete the GCP staging VPC peering before removing it from state (#330) #1144: delete the GCP staging VPC peering before removing it from state (edits cleanup-staging.yml, which is still enabled)

Changes to the disabled deploy workflows (no effect until they're re-enabled):

• fix(ci): fail Azure deploys on unreadable terraform outputs and show logs after a failed health check #1304: fail Azure deploys on unreadable terraform outputs (merged as 5af77d40)
• chore(ci): drop the unreachable Fargate caller job from deploy-all (#314) #1228: drop the unreachable Fargate caller job from deploy-all
• sec(ci): move the remaining run-block ${{ }} interpolations into env (#155) #1147: move run-block ${{ }} interpolations into env (also touches the active Fargate workflow and ci.yml)

Code-only Azure/GCP PRs (CI guards, tests, Go and frontend code) need no deploy and aren't tracked here.

Opened by IAmJSD's agent at IAmJSD's request (acting owner while the maintainers are away).