feat(plugin): phase 5 of sc-plugin-gcp extraction — delete in-tree GCP

cmd/schema-gen/main.go

@@ -16,24 +16,28 @@ import (
 	"golang.org/x/text/cases"
 	"golang.org/x/text/language"
 
+	// Import cloud provider packages directly to access their CloudExtras types
+	"github.com/simple-container-com/sc-plugin-aws/api"
+	_ "github.com/simple-container-com/sc-plugin-gcp/api"
+	_ "github.com/simple-container-com/sc-plugin-mongodb/api"
+	"github.com/simple-container-com/sc-plugin-yandex/api"
+
 	// Core API package for registration maps and configuration structs
 	"github.com/simple-container-com/api/pkg/api"
 	// Import all cloud provider packages to trigger init() functions
 	_ "github.com/simple-container-com/api/pkg/clouds/compose"
 	_ "github.com/simple-container-com/api/pkg/clouds/discord"
 	_ "github.com/simple-container-com/api/pkg/clouds/docker"
 	_ "github.com/simple-container-com/api/pkg/clouds/fs"
-	_ "github.com/simple-container-com/api/pkg/clouds/gcloud"
+	// pkg/clouds/gcloud blank-import replaced in phase 5 of the GCP
+	// plugin extraction with sc-plugin-gcp/api below (same shape as
+	// sc-plugin-{aws,mongodb,yandex}/api imports a few lines down).
 	_ "github.com/simple-container-com/api/pkg/clouds/github"
 	_ "github.com/simple-container-com/api/pkg/clouds/k3s"
 	"github.com/simple-container-com/api/pkg/clouds/k8s"
 	_ "github.com/simple-container-com/api/pkg/clouds/slack"
 	_ "github.com/simple-container-com/api/pkg/clouds/telegram"
 	_ "github.com/simple-container-com/api/pkg/clouds/vm"
-	// Import cloud provider packages directly to access their CloudExtras types
-	"github.com/simple-container-com/sc-plugin-aws/api"
-	_ "github.com/simple-container-com/sc-plugin-mongodb/api"
-	"github.com/simple-container-com/sc-plugin-yandex/api"
 )
 
 // ResourceDefinition holds metadata about a resource struct

docs/docs/reference/supported-resources.md

@@ -553,9 +553,9 @@ stacks:
 
 Deploys containerized applications on Google Cloud Run.
 
-**Golang Struct Reference:** `pkg/clouds/gcloud/cloudrun.go:CloudRunInput`
+**Golang Struct Reference:** `github.com/simple-container-com/sc-plugin-gcp/api/cloudrun.go:CloudRunTemplate`
 
-**JSON Schema:** [CloudRunInput Schema](https://github.com/simple-container-com/api/tree/main/docs/schemas/gcp/cloudruninput.json)
+**JSON Schema:** [CloudRunTemplate Schema](https://github.com/simple-container-com/api/tree/main/docs/schemas/gcp/cloudruntemplate.json)
 
 ```yaml
 # server.yaml - Parent Stack (DevOps managed)
@@ -566,13 +566,34 @@ templates:
       # GCP credentials and project (from TemplateConfig struct)
       projectId: "${auth:gcp-main.projectId}"
       credentials: "${auth:gcp-main}"
+      # Cloud Run is a regional resource — required.
+      region: us-central1
+      # Images from the client stack's docker-compose are built and
+      # pushed to this parent-stack gcp-artifact-registry resource
+      # before the Cloud Run service references them. Required.
+      artifactRegistryResource: my-registry
 
 resources:
   resources:
     production:
       template: my-cloudrun-template
+      resources:
+        my-registry:
+          type: gcp-artifact-registry
+          config:
+            credentials: "${auth:gcp-main}"
+            projectId: "${auth:gcp-main.projectId}"
+            location: us-central1
+            docker:
+              immutableTags: false
 ```
 
+The Cloud Run v2 Service auto-enables `run.googleapis.com` on first
+provision and is created with `deletion_protection: false` so `sc
+destroy` tears it down cleanly. A public `allUsers → roles/run.invoker`
+IAM binding is set by default; a future `access:` knob narrows this to
+authenticated-only or specific service accounts.
+
 **How Client Stacks Use This Template:**
 ```yaml
 # client.yaml - Client Stack (Developer managed)
@@ -597,7 +618,7 @@ stacks:
 
 Template for deploying applications to GKE Autopilot clusters. References GKE cluster and Artifact Registry resources.
 
-**Golang Struct Reference:** `pkg/clouds/gcloud/gke_autopilot.go:GkeAutopilotTemplate`
+**Golang Struct Reference:** `github.com/simple-container-com/sc-plugin-gcp/api/gke_autopilot.go:GkeAutopilotTemplate`
 
 ```yaml
 # server.yaml - Parent Stack (DevOps managed)
@@ -645,7 +666,7 @@ resources:
 
 Hosts static websites on Google Cloud Storage with Cloud CDN.
 
-**Golang Struct Reference:** `pkg/clouds/gcloud/static_website.go:StaticSiteInput`
+**Golang Struct Reference:** `github.com/simple-container-com/sc-plugin-gcp/api/static_website.go:StaticSiteInput`
 
 ```yaml
 # server.yaml
@@ -665,7 +686,7 @@ stacks:
 
 Creates and manages Google Kubernetes Engine Autopilot clusters as a resource.
 
-**Golang Struct Reference:** `pkg/clouds/gcloud/gke_autopilot.go:GkeAutopilotResource`
+**Golang Struct Reference:** `github.com/simple-container-com/sc-plugin-gcp/api/gke_autopilot.go:GkeAutopilotResource`
 
 **JSON Schema:** [GkeAutopilotResource Schema](https://github.com/simple-container-com/api/tree/main/docs/schemas/gcp/gkeautopilotresource.json)
 
@@ -755,7 +776,7 @@ resources:
 
 Template for deploying applications to GKE Autopilot clusters. References GKE cluster and Artifact Registry resources.
 
-**Golang Struct Reference:** `pkg/clouds/gcloud/gke_autopilot.go:GkeAutopilotTemplate`
+**Golang Struct Reference:** `github.com/simple-container-com/sc-plugin-gcp/api/gke_autopilot.go:GkeAutopilotTemplate`
 
 ```yaml
 # server.yaml - Template Definition
@@ -838,7 +859,7 @@ resources:
 
 Creates and manages Google Cloud Storage buckets with S3-compatible access via HMAC keys.
 
-**Golang Struct Reference:** `pkg/clouds/gcloud/bucket.go:GcpBucket`
+**Golang Struct Reference:** `github.com/simple-container-com/sc-plugin-gcp/api/bucket.go:GcpBucket`
 
 **JSON Schema:** [GcpBucket Schema](https://github.com/simple-container-com/api/tree/main/docs/schemas/gcp/gcpbucket.json)
 
@@ -870,7 +891,7 @@ When this resource is used in a client stack via the `uses` section, Simple Cont
 
 Creates and manages Google Artifact Registry repositories.
 
-**Golang Struct Reference:** `pkg/clouds/gcloud/artifactregistry.go:ArtifactRegistryConfig`
+**Golang Struct Reference:** `github.com/simple-container-com/sc-plugin-gcp/api/artifactregistry.go:ArtifactRegistryConfig`
 
 ```yaml
 # server.yaml - Parent Stack
@@ -934,7 +955,7 @@ An unrecognised key in `server.yaml` is silently ignored rather than rejected, s
 
 Creates and manages Google Cloud SQL PostgreSQL databases.
 
-**Golang Struct Reference:** `pkg/clouds/gcloud/postgres.go:PostgresGcpCloudsqlConfig`
+**Golang Struct Reference:** `github.com/simple-container-com/sc-plugin-gcp/api/postgres.go:PostgresGcpCloudsqlConfig`
 
 **JSON Schema:** [PostgresGcpCloudsqlConfig Schema](https://github.com/simple-container-com/api/tree/main/docs/schemas/gcp/postgresgcpcloudsqlconfig.json)
 
@@ -991,7 +1012,7 @@ Your container connects to Cloud SQL over `localhost` — the injected `*.host`/
 
 Creates and manages Google Cloud Memorystore Redis instances.
 
-**Golang Struct Reference:** `pkg/clouds/gcloud/redis.go:RedisConfig`
+**Golang Struct Reference:** `github.com/simple-container-com/sc-plugin-gcp/api/redis.go:RedisConfig`
 
 **JSON Schema:** [RedisConfig Schema](https://github.com/simple-container-com/api/tree/main/docs/schemas/gcp/redisconfig.json)
 
@@ -1031,7 +1052,7 @@ When this resource is used in a client stack via the `uses` section, Simple Cont
 
 Creates and manages Google Cloud Pub/Sub topics and subscriptions.
 
-**Golang Struct Reference:** `pkg/clouds/gcloud/pubsub.go:PubSubConfig`
+**Golang Struct Reference:** `github.com/simple-container-com/sc-plugin-gcp/api/pubsub.go:PubSubConfig`
 
 ```yaml
 # server.yaml - Parent Stack

go.mod

@@ -4,9 +4,7 @@ go 1.26.10
 
 require (
 	cloud.google.com/go/kms v1.26.0
-	cloud.google.com/go/storage v1.62.3
 	filippo.io/edwards25519 v1.2.0
-	github.com/MShekow/directory-checksum v1.4.18
 	github.com/Masterminds/semver/v3 v3.4.0
 	github.com/anthonycorbacho/slack-webhook v1.0.1
 	github.com/antonmedv/expr v1.12.6
@@ -46,17 +44,16 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/pulumi/pulumi-command/sdk v1.2.1
 	github.com/pulumi/pulumi-docker/sdk/v4 v4.11.2
-	github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1
 	github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0
 	github.com/pulumi/pulumi-random/sdk/v4 v4.21.0
 	github.com/pulumi/pulumi/pkg/v3 v3.245.0
 	github.com/pulumi/pulumi/sdk/v3 v3.245.0
 	github.com/samber/lo v1.53.0
 	github.com/simple-container-com/sc-plugin-aws/api v0.0.0-20261102081521-e5fd1e8fa7a8
 	github.com/simple-container-com/sc-plugin-cloudflare/api v0.0.0-20261031083455-cdbcf98c7bfb
+	github.com/simple-container-com/sc-plugin-gcp/api v0.0.0-20261108045141-58ce4b6cfa4a
 	github.com/simple-container-com/sc-plugin-mongodb/api v0.0.0-20261029130510-ff1589792eaa
 	github.com/simple-container-com/sc-plugin-yandex/api v0.0.0-20261101233310-67602079742f
-	github.com/spf13/afero v1.15.0
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
 	github.com/tmc/langchaingo v0.1.14
@@ -65,11 +62,9 @@ require (
 	go.uber.org/atomic v1.11.0
 	gocloud.dev v0.46.0
 	golang.org/x/crypto v0.58.0
-	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.24.0
 	golang.org/x/term v0.47.0
 	golang.org/x/text v0.43.0
-	google.golang.org/api v0.284.0
 	google.golang.org/grpc v1.83.2
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
 	gopkg.in/yaml.v2 v2.4.0
@@ -91,6 +86,7 @@ require (
 	cloud.google.com/go/logging v1.13.2 // indirect
 	cloud.google.com/go/longrunning v0.9.0 // indirect
 	cloud.google.com/go/monitoring v1.24.3 // indirect
+	cloud.google.com/go/storage v1.62.3 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/4meepo/tagalign v1.4.2 // indirect
 	github.com/Abirdcfly/dupword v0.1.3 // indirect
@@ -213,7 +209,6 @@ require (
 	github.com/git-pkgs/vers v0.2.4 // indirect
 	github.com/go-critic/go-critic v0.12.0 // indirect
 	github.com/go-delve/liner v1.2.3-0.20231231155935-4726ab1d7f62 // indirect
-	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.6 // indirect
 	github.com/go-logr/logr v1.4.4 // indirect
@@ -400,6 +395,7 @@ require (
 	github.com/sonatard/noctx v0.1.0 // indirect
 	github.com/sosodev/duration v1.4.0 // indirect
 	github.com/sourcegraph/go-diff v0.7.0 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/spf13/viper v1.21.0 // indirect
@@ -462,11 +458,13 @@ require (
 	golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 // indirect
 	golang.org/x/mod v0.41.0 // indirect
 	golang.org/x/net v0.62.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 	golang.org/x/telemetry v0.0.0-20260924152758-ed294f943157 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	golang.org/x/tools v0.51.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
+	google.golang.org/api v0.284.0 // indirect
 	google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect

go.sum

@@ -84,8 +84,6 @@ github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapp
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0/go.mod h1:Mf6O40IAyB9zR/1J8nGDDPirZQQPbYJni8Yisy7NTMc=
 github.com/HdrHistogram/hdrhistogram-go v1.1.2 h1:5IcZpTvzydCQeHzK4Ef/D5rrSqwxob0t8PQPMybUNFM=
 github.com/HdrHistogram/hdrhistogram-go v1.1.2/go.mod h1:yDgFjdqOqDEKOvasDdhWNXYg9BVp4O+o5f6V/ehm6Oo=
-github.com/MShekow/directory-checksum v1.4.18 h1:1nPPVl7uREa6WMTAPKoWW/GylhnASs0C9C+GPiwLwXA=
-github.com/MShekow/directory-checksum v1.4.18/go.mod h1:iUupsPb0X0BumQQymLrpD5Pkqe/CbV13OSgosw1oFc4=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
@@ -361,8 +359,6 @@ github.com/go-delve/delve v1.27.0 h1:i66Einw/sQhm0hlbjLNUNxrwCmKdTcIqpyHVqSWAbd0
 github.com/go-delve/delve v1.27.0/go.mod h1:l6Xb1ype6VEKoKZCaOg7mGN5B8Zi3Sn+K7qs5Pqqc8k=
 github.com/go-delve/liner v1.2.3-0.20231231155935-4726ab1d7f62 h1:IGtvsNyIuRjl04XAOFGACozgUD7A82UffYxZt4DWbvA=
 github.com/go-delve/liner v1.2.3-0.20231231155935-4726ab1d7f62/go.mod h1:biJCRbqp51wS+I92HMqn5H8/A0PAhxn2vyOT+JqhiGI=
-github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
-github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
 github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
@@ -803,8 +799,6 @@ github.com/pulumi/pulumi-command/sdk v1.2.1 h1:mAziZ91a/9U+5IjZH5Skcar80OSmpBSYl
 github.com/pulumi/pulumi-command/sdk v1.2.1/go.mod h1:hQxv9DXg6bFjcd9BEiNdMImQ/V1rnC9D115q5VXYNps=
 github.com/pulumi/pulumi-docker/sdk/v4 v4.11.2 h1:mc9IbrRi1pWSg9HWEFT6EcQ274WnZ97nyP2pmUEvSp4=
 github.com/pulumi/pulumi-docker/sdk/v4 v4.11.2/go.mod h1:gPNbbz+ywFqnRRQMDxQQbMp4nXJIk43QBUj0N+xWXbw=
-github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U=
-github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk=
 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0 h1:QwJzM3PseaorfASUlDXxsyntVGac7ZSYjqjxa038uoU=
 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0/go.mod h1:MtckkCd6mzQQ3AYw+qjdt6ROfdBB3dr8dI/dE5/jxrM=
 github.com/pulumi/pulumi-random/sdk/v4 v4.21.0 h1:j6LtoXue77y16trYOR40iqCUxXxv8TnxvOCOP/a0zVI=
@@ -874,6 +868,12 @@ github.com/simple-container-com/sc-plugin-aws/api v0.0.0-20261102081521-e5fd1e8f
 github.com/simple-container-com/sc-plugin-aws/api v0.0.0-20261102081521-e5fd1e8fa7a8/go.mod h1:xrWxpDoBjIeQhguBwoIsVj/JxTLpZHxyxqaGtbjUCJs=
 github.com/simple-container-com/sc-plugin-cloudflare/api v0.0.0-20261031083455-cdbcf98c7bfb h1:whdI/2NLI+LOis05ojruccP+v1UqydKFMJVH6WdDlz8=
 github.com/simple-container-com/sc-plugin-cloudflare/api v0.0.0-20261031083455-cdbcf98c7bfb/go.mod h1:grjigb/0Y7wQ5hT9eWnsIghVoumT2YWeo8x5B2hetSo=
+github.com/simple-container-com/sc-plugin-gcp v0.0.0-20261108045141-58ce4b6cfa4a h1:1BPNHNyBU3PV/TDqkOs1fd6r3yvV+s+P66MDwRUGPlM=
+github.com/simple-container-com/sc-plugin-gcp v0.0.0-20261108045141-58ce4b6cfa4a/go.mod h1:vFStCvcXkTyVIo6MN9BvudXRmAm4drwwN6d908KqXlw=
+github.com/simple-container-com/sc-plugin-gcp/api v0.0.0-20261107212225-8bf6d5d6f638 h1:h564wJ/YQs3wKyHdDjcp/aj1VzvpvjqkWLm/ebtWUiM=
+github.com/simple-container-com/sc-plugin-gcp/api v0.0.0-20261107212225-8bf6d5d6f638/go.mod h1:ebRWOMTQAIyTtzDzB27cx5FidTdjDF57fSpCcVBWn3c=
+github.com/simple-container-com/sc-plugin-gcp/api v0.0.0-20261108045141-58ce4b6cfa4a h1:XrF9fCS3a76uqO+fLs7vRb636oDtQJZoKpF2XMCvbA0=
+github.com/simple-container-com/sc-plugin-gcp/api v0.0.0-20261108045141-58ce4b6cfa4a/go.mod h1:ebRWOMTQAIyTtzDzB27cx5FidTdjDF57fSpCcVBWn3c=
 github.com/simple-container-com/sc-plugin-mongodb/api v0.0.0-20261029130510-ff1589792eaa h1:y+iTXrgLbZdP5WCSdbkdFOcDzANk+uBqszuVtJue+VE=
 github.com/simple-container-com/sc-plugin-mongodb/api v0.0.0-20261029130510-ff1589792eaa/go.mod h1:hcPcAX/B6qNRSqkYYE5IDeQviydAmjQ39S9sKmJnmPw=
 github.com/simple-container-com/sc-plugin-yandex/api v0.0.0-20261101233310-67602079742f h1:4CHL1KWcyF979Y2qW4OKeHf3QMKl3Ih6CgBkoaDzBvU=

pkg/api/git/testdata/repo/stacks/common/server.yaml

@@ -36,6 +36,11 @@ cicd:
   config:
     auth-token: "${secret:GITHUB_TOKEN}"
 plugins:
+  gcp:
+    source:
+      type: github-release
+      repository: simple-container-com/sc-plugin-gcp
+      version: v2026.11.08-d14f4da
   cloudflare:
     source:
       type: github-release

pkg/api/plugin_bootstrap.go

@@ -111,6 +111,43 @@ func init() {
 			Repository: "simple-container-com/sc-plugin-mongodb",
 		},
 	})
+	RegisterPluginRequirement(PluginRequirement{
+		PluginName: "gcp",
+		// Full token list sc-plugin-gcp owns after the phase 5 extraction
+		// of pkg/clouds/gcloud + pkg/clouds/pulumi/gcp out of api core.
+		// Must stay in sync with sc-plugin-gcp/api/init.go's OwnedTypes.
+		// Same shape as the aws/yandex/cloudflare/cloudru/mongodb entries
+		// above — one DefaultSource; operators who paste any of these
+		// tokens into server.yaml without a `plugins: gcp:` block get
+		// auto-inject via ValidatePluginRequirements.
+		OwnedTypes: []string{
+			// provider
+			"gcp",
+			// auth
+			"gcp-service-account",
+			// secrets
+			"gcp-secrets-manager",
+			// state store
+			"gcp-bucket",
+			// secrets provider (Pulumi stack-secrets)
+			"gcp-kms",
+			// resources
+			"gcp-pubsub",
+			"gcp-redis",
+			"gcp-cloudsql-postgres",
+			"gcp-artifact-registry",
+			"gcp-docker-image-push",
+			"gcp-gke-autopilot-cluster",
+			// templates
+			"cloudrun",
+			"gcp-static-website",
+			"gcp-gke-autopilot",
+		},
+		DefaultSource: PluginSource{
+			Type:       "github-release",
+			Repository: "simple-container-com/sc-plugin-gcp",
+		},
+	})
 
 	// ALSO populate providerConfigMapping (via RegisterPluginOwnedType)
 	// for every bootstrap token, so DetectResourcesType / DetectAuthType /
@@ -170,6 +207,26 @@ func init() {
 		"mongodb": {
 			PluginOwnedKindResource: {"mongodb-atlas"},
 		},
+		"gcp": {
+			// Provider + resources + templates all seed providerConfigMapping
+			// identically (RegisterPluginOwnedType's kind field is read only
+			// by the state-store / secrets-provider / auth post-processing).
+			PluginOwnedKindResource: {
+				"gcp",
+				"gcp-pubsub",
+				"gcp-redis",
+				"gcp-cloudsql-postgres",
+				"gcp-artifact-registry",
+				"gcp-docker-image-push",
+				"gcp-gke-autopilot-cluster",
+				"cloudrun",
+				"gcp-static-website",
+				"gcp-gke-autopilot",
+			},
+			PluginOwnedKindStateStore:      {"gcp-bucket"},
+			PluginOwnedKindSecretsProvider: {"gcp-kms", "gcp-secrets-manager"},
+			PluginOwnedKindAuth:            {"gcp-service-account"},
+		},
 	} {
 		for kind, tokens := range kinds {
 			// Strip the "/auth" sentinel — the kind for auth is

pkg/api/secrets/testdata/repo/stacks/common/server.yaml

@@ -34,6 +34,11 @@ cicd:
   config:
     auth-token: "${secret:GITHUB_TOKEN}"
 plugins:
+  gcp:
+    source:
+      type: github-release
+      repository: simple-container-com/sc-plugin-gcp
+      version: v2026.11.08-d14f4da
   cloudflare:
     source:
       type: github-release