refactor(meshstack/noop): take the runner's GCP project from test_context

[JohannesRudolph]

The meshstack/noop runner e2e module reads its GCP project from TF_VAR_gcp_project_id. That is an
environment fact the smoke-test harness already publishes in test_context as
fixtures.gcp.project_id, and keeping it as an env var means it is wired in two places nothing
checks against each other — which is how this test broke silently once already.

The e2e-test skill records the rule: an e2e/ module takes every environment fact from
test_context, and only secrets arrive as TF_VAR_* (GitHub masks values one by one, so a secret
cannot ride in the grab-bag).

Rebased 2026-09-07

This PR was opened as the hub half of a stacked rollout whose harness PRs were later closed in favour
of a different design, which has since merged. Rebased onto that design and reduced to the half that
still applies:

• gcp_project_id → test_context.fixtures.gcp.project_id — kept. The fixture field already
  exists on the harness side, so this has no prerequisite. The harness workflow still exports the
  Actions variable and says in a comment that it does so only because this module declares the root
  variable, so merging this is what lets that go.
• meshstack_endpoint → test_context.meshstack_endpoint — dropped. That field was to be added
  by one of the closed harness PRs and does not exist; the endpoint travels the secret pipe today. The
  variable keeps a comment saying it should move once the harness publishes it.
• Docs — reworded against the current skill, whose Secrets section already covers the exception.
  The pointer to a harness rule that never landed is gone.

Verification

tofu validate on the runner module, with TF_VAR_test_context supplied (its const hub.git_ref
makes the variable necessary at validate time, not just init), and pre-commit run on the touched
files.

The e2e run itself is verified by a single-module dispatch:
gh workflow run smoke-test.yml -f module=meshstack/noop -f meshstack_hub_ref=refs/pull/288/head.

Follow-ups

1. Harness: drop the TF_VAR_gcp_project_id line and the GCP_PROJECT_ID Actions variable once this
   merges.
2. Harness: publish meshstack_endpoint in the fixtures state output — it is not secret, so by that
   design's own rule it belongs in the state pipe rather than the secret pump. Then this module's last
   TF_VAR_* fixture can go too.

🤖 Generated with Claude Code

[github-actions]

Scorecard Check

Scorecard run on commit 1c342a7b99e7613ceac070f5d0252d9e008ae495 relative to origin/main

📊 meshstack-hub Module Scorecard

Generated: 2026-09-07 | Modules scanned: 1 | Categories: 7

📋 Per-Module Category Summary

Score per category per building block. n/a = category does not apply to this module.

Module	Overall	Core Structure	Integration	AWS Backplane	Azure Backplane	GCP Backplane	STACKIT Backplane	Testing
meshstack/noop	🟢 96%	🟢 83%	🟢 100%	n/a	n/a	n/a	n/a	🟢 100%

⚠️ 1 module has failing checks — failing categories are expanded below.

Core Structure — some checks failing

Basic module file structure and documentation — applies to 1 modules

Module	Score	📦	🔗	📋	📝	🖼️	📌	🚦	🔒
meshstack/noop	🟢 83%	✅	✅	➖	✅	✅	✅	➖	❌

Core Structure — Summary

Emoji	Criterion	Coverage	Status
📦	buildingblock/ directory exists	1/1	🟢 100%
🔗	meshstack_integration.tf present	1/1	🟢 100%
📋	buildingblock/APP_TEAM_README.md present (no-integration fallback)	n/a	—
📝	buildingblock/README.md with YAML front-matter	1/1	🟢 100%
🖼️	buildingblock/logo.png included	1/1	🟢 100%
📌	buildingblock/versions.tf present	1/1	🟢 100%
🚦	Child meshstack_building_block asserts a SUCCEEDED run	n/a	—
🔒	Provider versions use minimum constraint (>=)	0/1	🔴 0%

Integration — ✅ all passing

meshstack_integration.tf conventions — applies to 1 modules

Module	Score	🏷️	🏢	📤	🔌	📎	🔀	🌱	📋	🏷️	🧱	📖	📝	📊	🚫	🔄
meshstack/noop	🟢 100%	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	➖

Integration — Summary

Emoji	Criterion	Coverage	Status
🏷️	variable "hub" in integration	1/1	🟢 100%
🏢	variable "meshstack" in integration	1/1	🟢 100%
📤	building_block_definition output exposed	1/1	🟢 100%
🔌	meshcloud/meshstack in required_providers	1/1	🟢 100%
📎	backplane source uses var.hub.git_ref	1/1	🟢 100%
🔀	ref_name uses var.hub.git_ref	1/1	🟢 100%
🌱	BBD terraform_version >= 1.12.0	1/1	🟢 100%
📋	version_spec.draft uses var.hub.bbd_draft	1/1	🟢 100%
🏷️	BBD metadata.tags forwards var.meshstack.tags	1/1	🟢 100%
🧱	BBD input argument vars with optional() have explicit defaults	1/1	🟢 100%
📖	BBD readme field present	1/1	🟢 100%
📝	BBD readme starts with plain-text description (no heading)	1/1	🟢 100%
📊	BBD readme has shared responsibility table (✅/❌)	1/1	🟢 100%
🚫	No documentation_md output in backplane	1/1	🟢 100%
🔄	meshstack_platform has lifecycle ignore_changes = [availability]	n/a	—

AWS Backplane — not applicable

AWS automation principal conventions (WIF or cross-account StackSet) — applies to 0 modules

No applicable modules.

Azure Backplane — not applicable

Azure UAMI-based automation principal conventions — applies to 0 modules

No applicable modules.

GCP Backplane — not applicable

GCP workload-identity-federation automation principal conventions — applies to 0 modules

No applicable modules.

STACKIT Backplane — not applicable

STACKIT WIF-based automation principal conventions — applies to 0 modules

No applicable modules.

Testing — ✅ all passing

End-to-end test coverage — applies to 1 modules

Module	Score	⚙️	🧪	🚫	✅
meshstack/noop	🟢 100%	✅	✅	✅	✅

Testing — Summary

Emoji	Criterion	Coverage	Status
⚙️	backplane/ directory (optional tier)	1/1	🟢 100%
🧪	e2e/ test directory exists	1/1	🟢 100%
🚫	no .tftest.hcl outside e2e/	1/1	🟢 100%
✅	e2e/ contains .tftest.hcl files	1/1	🟢 100%

[aws-amplify-eu-central-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-288.d1o16zfeoh2slu.amplifyapp.com