chore: import upstream snapshot with attribution

tests/remote/triggers/terraform/cloud_run.tf

@@ -0,0 +1,35 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# ---------------------------------------------------------------------------
+# ADK Agent for trigger testing.
+#
+# This configuration references a Cloud Run service that has been deployed
+# manually (e.g. via `gcloud run deploy`) before running Terraform.
+# ---------------------------------------------------------------------------
+
+locals {
+  service_name = var.service_name != null ? var.service_name : "${local.name_prefix}-${local.suffix}"
+}
+
+# Read the service back as a data source so other resources can reference
+# its URL and attributes.
+data "google_cloud_run_v2_service" "trigger_agent" {
+  name     = local.service_name
+  location = var.region
+  project  = var.project_id
+}
+
+# No longer using resource "google_cloud_run_v2_service" to avoid
+# deployment conflicts with local tools.

tests/remote/triggers/terraform/eventarc.tf

@@ -0,0 +1,120 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# ---------------------------------------------------------------------------
+# Eventarc: separate Pub/Sub topic as event source → Cloud Run /trigger/eventarc
+# ---------------------------------------------------------------------------
+
+# A dedicated topic that acts as the Eventarc event source.
+# Publishing to this topic triggers the Eventarc → Cloud Run pipeline.
+resource "google_pubsub_topic" "eventarc_source" {
+  name    = "${local.name_prefix}-eventarc-${local.suffix}"
+  project = var.project_id
+
+  depends_on = [google_project_service.apis]
+}
+
+resource "google_eventarc_trigger" "trigger_test" {
+  name     = "${local.name_prefix}-${local.suffix}"
+  location = var.region
+  project  = var.project_id
+
+  matching_criteria {
+    attribute = "type"
+    value     = "google.cloud.pubsub.topic.v1.messagePublished"
+  }
+
+  transport {
+    pubsub {
+      topic = google_pubsub_topic.eventarc_source.id
+    }
+  }
+
+  destination {
+    cloud_run_service {
+      service = data.google_cloud_run_v2_service.trigger_agent.name
+      path    = "/apps/trigger_echo_agent/trigger/eventarc"
+      region  = var.region
+    }
+  }
+
+  service_account = google_service_account.eventarc_invoker.email
+
+  depends_on = [
+    google_project_iam_member.eventarc_event_receiver,
+    google_project_service.apis,
+  ]
+}
+
+# ---------------------------------------------------------------------------
+# GCS Trigger Test
+# ---------------------------------------------------------------------------
+
+resource "random_id" "bucket_suffix" {
+  byte_length = 4
+}
+
+resource "google_storage_bucket" "trigger_test_bucket" {
+  name          = "${local.name_prefix}-bucket-${local.suffix}-${random_id.bucket_suffix.hex}"
+  location      = var.region
+  project       = var.project_id
+  force_destroy = true
+
+  uniform_bucket_level_access = true
+
+  depends_on = [google_project_service.apis]
+}
+
+data "google_storage_project_service_account" "gcs_account" {
+  project = var.project_id
+}
+
+resource "google_project_iam_member" "gcs_pubsub_publisher" {
+  project = var.project_id
+  role    = "roles/pubsub.publisher"
+  member  = "serviceAccount:${data.google_storage_project_service_account.gcs_account.email_address}"
+
+  depends_on = [data.google_storage_project_service_account.gcs_account]
+}
+
+resource "google_eventarc_trigger" "gcs_trigger" {
+  name     = "${local.name_prefix}-gcs-${local.suffix}"
+  location = var.region
+  project  = var.project_id
+
+  matching_criteria {
+    attribute = "type"
+    value     = "google.cloud.storage.object.v1.finalized"
+  }
+  matching_criteria {
+    attribute = "bucket"
+    value     = google_storage_bucket.trigger_test_bucket.name
+  }
+
+  destination {
+    cloud_run_service {
+      service = data.google_cloud_run_v2_service.trigger_agent.name
+      path    = "/apps/trigger_echo_agent/trigger/eventarc"
+      region  = var.region
+    }
+  }
+
+  service_account = google_service_account.eventarc_invoker.email
+
+  depends_on = [
+    google_project_iam_member.eventarc_event_receiver,
+    google_project_iam_member.gcs_pubsub_publisher,
+    google_project_service.apis,
+  ]
+}

tests/remote/triggers/terraform/iam.tf

@@ -0,0 +1,80 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# ---------------------------------------------------------------------------
+# IAM bindings and Service Accounts for Cloud Run invokers.
+# ---------------------------------------------------------------------------
+
+# Service account for the Cloud Run agent itself.
+resource "google_service_account" "cloud_run" {
+  account_id   = "${local.name_prefix}-run-${local.suffix}"
+  display_name = "ADK Trigger Test - Cloud Run Agent"
+  project      = var.project_id
+}
+
+# Service account for Pub/Sub to invoke Cloud Run.
+resource "google_service_account" "pubsub_invoker" {
+  account_id   = "${local.name_prefix}-ps-${local.suffix}"
+  display_name = "ADK Trigger Test - Pub/Sub Invoker"
+  project      = var.project_id
+}
+
+# Service account for Eventarc to invoke Cloud Run.
+resource "google_service_account" "eventarc_invoker" {
+  account_id   = "${local.name_prefix}-ea-${local.suffix}"
+  display_name = "ADK Trigger Test - Eventarc Invoker"
+  project      = var.project_id
+}
+
+resource "google_cloud_run_v2_service_iam_member" "pubsub_invoker" {
+  name     = data.google_cloud_run_v2_service.trigger_agent.name
+  location = var.region
+  project  = var.project_id
+  role     = "roles/run.invoker"
+  member   = "serviceAccount:${google_service_account.pubsub_invoker.email}"
+}
+
+resource "google_cloud_run_v2_service_iam_member" "eventarc_invoker" {
+  name     = data.google_cloud_run_v2_service.trigger_agent.name
+  location = var.region
+  project  = var.project_id
+  role     = "roles/run.invoker"
+  member   = "serviceAccount:${google_service_account.eventarc_invoker.email}"
+}
+
+
+# Eventarc requires the receiver role on the invoker service account.
+resource "google_project_iam_member" "eventarc_event_receiver" {
+  project = var.project_id
+  role    = "roles/eventarc.eventReceiver"
+  member  = "serviceAccount:${google_service_account.eventarc_invoker.email}"
+}
+
+data "google_project" "project" {
+  project_id = var.project_id
+}
+
+# Grant the Pub/Sub service agent permission to create OIDC tokens for the pubsub_invoker SA
+resource "google_service_account_iam_member" "pubsub_token_creator" {
+  service_account_id = google_service_account.pubsub_invoker.name
+  role               = "roles/iam.serviceAccountTokenCreator"
+  member             = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-pubsub.iam.gserviceaccount.com"
+}
+
+# Grant the Pub/Sub service agent permission to create OIDC tokens for the eventarc_invoker SA
+resource "google_service_account_iam_member" "eventarc_token_creator" {
+  service_account_id = google_service_account.eventarc_invoker.name
+  role               = "roles/iam.serviceAccountTokenCreator"
+  member             = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-pubsub.iam.gserviceaccount.com"
+}

tests/remote/triggers/terraform/main.tf

@@ -0,0 +1,64 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+terraform {
+  required_version = ">= 1.0.0"
+
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = ">= 5.0.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.0.0"
+    }
+  }
+}
+
+provider "google" {
+  project = var.project_id
+  region  = var.region
+
+  default_labels = {
+    goog-terraform-provisioned = "true"
+  }
+}
+
+# Random suffix to avoid resource name collisions across parallel test runs.
+resource "random_id" "suffix" {
+  byte_length = 4
+}
+
+locals {
+  suffix      = var.suffix != null ? var.suffix : random_id.suffix.hex
+  name_prefix = "adk-trigger-test"
+
+  required_apis = [
+    "run.googleapis.com",
+    "pubsub.googleapis.com",
+    "cloudbuild.googleapis.com",
+    "eventarc.googleapis.com",
+    "logging.googleapis.com",
+  ]
+}
+
+resource "google_project_service" "apis" {
+  for_each = toset(local.required_apis)
+
+  project = var.project_id
+  service = each.value
+
+  disable_on_destroy = false
+}

tests/remote/triggers/terraform/outputs.tf

@@ -0,0 +1,56 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+output "cloud_run_url" {
+  description = "Base URL of the deployed Cloud Run trigger-echo-agent service."
+  value       = data.google_cloud_run_v2_service.trigger_agent.uri
+}
+
+output "pubsub_topic" {
+  description = "Fully qualified Pub/Sub topic name for direct-push tests."
+  value       = google_pubsub_topic.trigger_test.id
+}
+
+output "pubsub_topic_short" {
+  description = "Short Pub/Sub topic name."
+  value       = google_pubsub_topic.trigger_test.name
+}
+
+output "eventarc_topic" {
+  description = "Fully qualified Pub/Sub topic name that fires the Eventarc trigger."
+  value       = google_pubsub_topic.eventarc_source.id
+}
+
+output "eventarc_topic_short" {
+  description = "Short Eventarc source topic name."
+  value       = google_pubsub_topic.eventarc_source.name
+}
+
+
+
+
+output "project_id" {
+  description = "GCP project ID used for test resources."
+  value       = var.project_id
+}
+
+output "region" {
+  description = "GCP region used for test resources."
+  value       = var.region
+}
+
+output "suffix" {
+  description = "The random suffix used for resource naming."
+  value       = local.suffix
+}

tests/remote/triggers/terraform/pubsub.tf

@@ -0,0 +1,54 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# ---------------------------------------------------------------------------
+# Pub/Sub topic + push subscription pointing to /trigger/pubsub
+# ---------------------------------------------------------------------------
+
+resource "google_pubsub_topic" "trigger_test" {
+  name    = "${local.name_prefix}-${local.suffix}"
+  project = var.project_id
+
+  depends_on = [google_project_service.apis]
+}
+
+resource "google_pubsub_subscription" "trigger_push" {
+  name    = "${local.name_prefix}-push-${local.suffix}"
+  project = var.project_id
+  topic   = google_pubsub_topic.trigger_test.id
+
+  push_config {
+    push_endpoint = "${data.google_cloud_run_v2_service.trigger_agent.uri}/apps/trigger_echo_agent/trigger/pubsub"
+
+    oidc_token {
+      service_account_email = google_service_account.pubsub_invoker.email
+      audience              = data.google_cloud_run_v2_service.trigger_agent.uri
+    }
+  }
+
+  # Short ack deadline for faster test feedback.
+  ack_deadline_seconds = 30
+
+  # Retry policy for failed pushes.
+  retry_policy {
+    minimum_backoff = "10s"
+    maximum_backoff = "60s"
+  }
+
+  # Let the subscription persist until Terraform destroys it.
+  # (default retention of 604800s is fine for tests)
+  expiration_policy {
+    ttl = ""
+  }
+}

tests/remote/triggers/terraform/variables.tf

@@ -0,0 +1,42 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+variable "project_id" {
+  description = "GCP project ID for test resources."
+  type        = string
+}
+
+variable "region" {
+  description = "GCP region for Cloud Run and related resources."
+  type        = string
+  default     = "us-central1"
+}
+
+variable "simulate_429_count" {
+  description = "Number of 429 errors the echo agent simulates before succeeding (0 = disabled)."
+  type        = number
+  default     = 0
+}
+
+variable "service_name" {
+  description = "Optional name of a pre-deployed Cloud Run service. If provided, Terraform will use it instead of generating a name from the suffix."
+  type        = string
+  default     = null
+}
+
+variable "suffix" {
+  description = "Optional suffix for resource naming. If not provided, a random one will be generated."
+  type        = string
+  default     = null
+}