Document proxy resource release gate

.github/workflows/acceptance.yml

@@ -11,22 +11,47 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  browser-pool:
-    name: Browser pool acceptance
+  durable-resource:
+    name: ${{ matrix.name }} acceptance
     runs-on: ubuntu-latest
-    # Keep the job timeout above the go test -timeout below: the job budget
-    # also covers checkout/toolchain setup, and if it fires first it kills the
-    # test process before t.Cleanup can delete the pools it created.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Browser pool
+            package: ./internal/resources/browserpool
+            project_id_required: true
+          - name: Browser pool data source
+            package: ./internal/datasources/browserpool
+            project_id_required: true
+          - name: Project
+            package: ./internal/resources/project
+            project_id_required: false
+          - name: Extension
+            package: ./internal/resources/extension
+            project_id_required: true
+    # Keep the job timeout above the go test timeout so Go can report the test
+    # timeout before the runner stops the job. Either hard timeout can bypass
+    # t.Cleanup, so release operators still inspect for leaked test resources.
     timeout-minutes: 40
     env:
       TF_ACC: "1"
       KERNEL_ACC: "1"
-      KERNEL_API_KEY: ${{ secrets.KERNEL_API_KEY }}
-      KERNEL_PROJECT_ID: ${{ secrets.KERNEL_PROJECT_ID }}
-      KERNEL_ALT_PROJECT_ID: ${{ secrets.KERNEL_ALT_PROJECT_ID }}
-      KERNEL_BASE_URL: ${{ secrets.KERNEL_BASE_URL }}
 
     steps:
+      - name: Check API key secret
+        env:
+          KERNEL_API_KEY: ${{ secrets.KERNEL_API_KEY }}
+        run: |
+          : "${KERNEL_API_KEY:?Set the KERNEL_API_KEY repository secret before running acceptance tests.}"
+
+      - name: Check project secret
+        if: matrix.project_id_required
+        env:
+          KERNEL_PROJECT_ID: ${{ secrets.KERNEL_PROJECT_ID }}
+        run: |
+          : "${KERNEL_PROJECT_ID:?Set the KERNEL_PROJECT_ID repository secret before running project-scoped acceptance tests.}"
+
       - name: Checkout
         uses: actions/checkout@v6
 
@@ -42,10 +67,10 @@ jobs:
           terraform_version: "1.15.5"
           terraform_wrapper: false
 
-      - name: Check required secrets
-        run: |
-          : "${KERNEL_API_KEY:?Set the KERNEL_API_KEY repository secret before running acceptance tests.}"
-          : "${KERNEL_PROJECT_ID:?Set the KERNEL_PROJECT_ID repository secret before running acceptance tests.}"
-
-      - name: Run browser pool acceptance tests
-        run: go test -count=1 -timeout=30m -v ./internal/resources/browserpool -run TestAcc
+      - name: Run acceptance tests
+        env:
+          KERNEL_API_KEY: ${{ secrets.KERNEL_API_KEY }}
+          KERNEL_BASE_URL: ${{ secrets.KERNEL_BASE_URL }}
+          KERNEL_PROJECT_ID: ${{ matrix.project_id_required && secrets.KERNEL_PROJECT_ID || '' }}
+          KERNEL_ALT_PROJECT_ID: ${{ matrix.project_id_required && secrets.KERNEL_ALT_PROJECT_ID || '' }}
+        run: go test -count=1 -timeout=30m -v ${{ matrix.package }} -run TestAcc

README.md

@@ -4,17 +4,19 @@ Terraform provider for durable Kernel infrastructure configuration.
 
 This provider manages desired state only. Browser/session runtime operations stay in the Kernel SDK and API.
 
-## Supported In v0
+## Supported
 
 Provider configuration:
 
 - `api_key`
 - `base_url`
 - `project_id`
 
-Resource:
+Resources:
 
 - `kernel_browser_pool`
+- `kernel_extension`
+- `kernel_project`
 
 Data sources:
 
@@ -26,8 +28,10 @@ Data sources:
 Import:
 
 - `kernel_browser_pool` by canonical browser pool ID
+- `kernel_extension` by canonical extension ID, optionally qualified with its project ID
+- `kernel_project` by canonical project ID
 
-## Not Supported In v0
+## Not Supported
 
 The provider intentionally does not manage:
 
@@ -37,8 +41,8 @@ The provider intentionally does not manage:
 - logs, screenshots, or live view
 - runtime status or standby state
 - force-release or recovery operations
-- API key or project resources
-- extension upload, download, delete, or Chrome Store operations
+- API key, profile, proxy, or deployment resources
+- extension download or Chrome Web Store download operations
 
 ## Quickstart
 
@@ -74,11 +78,16 @@ resource "kernel_browser_pool" "example" {
 }
 ```
 
-Import an existing browser pool. The bare form resolves the project like create (provider default, else the API key's binding); use the project-qualified form to import from a different project:
+Import existing resources by canonical ID. For browser pools, the bare form
+resolves the project like create (provider default, else the API key's binding);
+use the project-qualified form to import from a different project:
 
 ```sh
 terraform import kernel_browser_pool.example <browser-pool-id>
 terraform import kernel_browser_pool.example <project-id>/<browser-pool-id>
+terraform import kernel_extension.example <extension-id>
+terraform import kernel_extension.example <project-id>/<extension-id>
+terraform import kernel_project.example <project-id>
 ```
 
 ## Local Development
@@ -128,22 +137,32 @@ Do not run `terraform init` just to exercise this unreleased provider through `d
 
 Acceptance tests are opt-in because they can create real Kernel resources.
 
-Required environment:
+Required for all acceptance tests:
 
 ```sh
 export TF_ACC=1
 export KERNEL_ACC=1
 export KERNEL_API_KEY="..."
+```
+
+Browser-pool acceptance tests additionally require:
+
+```sh
 export KERNEL_PROJECT_ID="..."
 ```
 
-Run the browser-pool acceptance test:
+Run the durable resource acceptance tests:
 
 ```sh
-go test -v ./internal/resources/browserpool -run TestAccBrowserPoolLifecycle
+go test -count=1 -timeout=30m -v ./internal/resources/browserpool -run TestAcc
+go test -count=1 -timeout=30m -v ./internal/resources/extension -run TestAcc
+go test -count=1 -timeout=30m -v ./internal/resources/project -run TestAcc
 ```
 
-The acceptance test creates uniquely named browser pools and uses durable `force=false` cleanup. It does not acquire browsers or perform runtime recovery.
+The tests create uniquely named durable resources and register independent
+cleanup. Extension acceptance creates a small temporary Manifest V3 archive and
+tests checksum-driven replacement. Browser-pool deletion remains `force=false`.
+The tests do not acquire browsers or perform runtime recovery.
 
 ## Architecture