fix: duplicate some Cloud Run IAM grants to functions-python module

[jcpitre]

Problem

This was a new error that happened after merging #1737

The datasets-batch-deployer-dev workflow was failing with:

Error 404: Resource 'gtfs-datasets-comparer-dev' of kind 'SERVICE' ... does not exist.

infra/batch/main.tf had two google_cloud_run_service_iam_member resources that granted roles/run.invoker on the pmtiles-builder-dev and gtfs-datasets-comparer-dev Cloud Run services by hardcoded name. These services are deployed by a separate workflow (api-dev/infra/functions-python), so if they don't exist yet — as was the case after renaming gtfs-change-tracker → gtfs-datasets-comparer — Terraform fails trying to set IAM on a non-existent resource.

Solution

Moved the two google_cloud_run_service_iam_member resources from infra/batch/main.tf into infra/functions-python/main.tf, co-located with the google_cloudfunctions2_function resources that actually create those services. Using google_cloudfunctions2_function.X.name as the service reference creates an implicit dependency, ensuring the Cloud Run service exists before IAM is applied. This follows the same pattern already used for the tokens and operations_api functions.

Also removed the now-unused function_pmtiles_builder_config and function_gtfs_datasets_comparer_config locals from infra/batch/main.tf.

Please make sure these boxes are checked before submitting your pull request - thanks!

• Run the unit tests with ./scripts/api-tests.sh to make sure you didn't break anything
• Add or update any needed documentation to the repo
• Format the title like "feat: [new feature short description]". Title must follow the Conventional Commit Specification(https://www.conventionalcommits.org/en/v1.0.0/).
• Linked all relevant issues
• Include screenshot(s) showing how this pull request works and fixes the issue(s)

[davidgamez]

Is this not affecting the pmtiles builder queue?

[davidgamez]

I think we need the iam permission in both TF files rather than moving the role from one to another.

[jcpitre]

I think we need the iam permission in both TF files rather than moving the role from one to another.

We could have them in both. But there would still be a problem since pmtiles_builder_invoker would still refer to a service that is created in python-function. See here

[davidgamez]

I think we need the iam permission in both TF files rather than moving the role from one to another.

We could have them in both. But there would still be a problem since pmtiles_builder_invoker would still refer to a service that is created in python-function. See here

The issue is that if the permission is not present, the Cloud Task will fail. We had planned(not done yet...) to merge these two TF files so we can avoid this cross-reference issue (completely out of scope in this PR)

[jcpitre]

I think we need the iam permission in both TF files rather than moving the role from one to another.

We could have them in both. But there would still be a problem since pmtiles_builder_invoker would still refer to a service that is created in python-function. See here

The issue is that if the permission is not present, the Cloud Task will fail. We had planned(not done yet...) to merge these two TF files so we can avoid this cross-reference issue (completely out of scope in this PR)

I put back the permissions in batch