Allstar operations overview follow-ups

@jeffmendoza ran a quick Allstar operations overview for the other @ossf/scorecard-admins (Steering) members and I want to make sure we capture some of the content and potential follow-ups as an issue.

GCP access

• Stephen, Spencer, and Raghav now have Owner access to GCP instance
• Configure access for additional Scorecard maintainers

Deployment

Pushes to main branch get deployed to staging instance via Google Cloud Build (GCB).
Container images are built via ko and then pushed to Google Container Registry (GCR).

Allstar runs on App Engine flexible environments.

Production deployments are manual runs (app-prod.yml) within the GCP console.

Actions

• Migrate from GCR to Google Artifact Registry (GAR) (need to do this for scorecard as well)
  • Dual-publish to/use instead GitHub Container Registry (GHCR)?
• Allstar replatformed to use GKE internally at Google. Raghav to share Terraform examples to bootstrap GKE instance
• Share Jeff's custom log queries across the GCP project
• Secrets: not using KMS (potentially use Chainguard Octo STS config workflow as an example)

What would Jeff fix?

• Shard over installation IDs (need GKE + StatefulSets)
• Multiple public instances to allow for Branch Protection usage
• Make it easier for people to run Allstar e.g.,
  • better operator.md
  • oneshot via GitHub Actions (or other mechanism?; needs PAT)
• Mechanism for surfacing operations status e.g., status page, badge, etc. (same for scorecard)
• Logging and monitoring work