From 6a2bc0182884addd8c8f87301c27b831d70a14ce Mon Sep 17 00:00:00 2001
From: Andrew Peabody <andrewpeabody@google.com>
Date: Mon, 11 May 2026 19:22:13 +0000
Subject: [PATCH] fix(cli): ensure stable sorting for blueprint roles in
 metadata

---
 cli/bpmetadata/tfconfig.go      |  8 ++++---
 cli/bpmetadata/tfconfig_test.go | 39 +++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/cli/bpmetadata/tfconfig.go b/cli/bpmetadata/tfconfig.go
index 894560e1a60..a35dd5597ae 100644
--- a/cli/bpmetadata/tfconfig.go
+++ b/cli/bpmetadata/tfconfig.go
@@ -463,9 +463,11 @@ func sortBlueprintRoles(r []*BlueprintRoles) {
 			return len(r[i].Roles) < len(r[j].Roles)
 		}
 
-		// 3. Sort by the first role (if available)
-		if len(r[i].Roles) > 0 && len(r[j].Roles) > 0 {
-			return r[i].Roles[0] < r[j].Roles[0]
+		// 3. Sort by each role in the list
+		for k := 0; k < len(r[i].Roles); k++ {
+			if r[i].Roles[k] != r[j].Roles[k] {
+				return r[i].Roles[k] < r[j].Roles[k]
+			}
 		}
 
 		return false
diff --git a/cli/bpmetadata/tfconfig_test.go b/cli/bpmetadata/tfconfig_test.go
index ef0d5a86452..2d601512273 100644
--- a/cli/bpmetadata/tfconfig_test.go
+++ b/cli/bpmetadata/tfconfig_test.go
@@ -399,6 +399,45 @@ func TestSortBlueprintRoles(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "sort by roles list content (real world)",
+			in: []*BlueprintRoles{
+				{
+					Level: "Project",
+					Roles: []string{
+						"roles/compute.admin",
+						"roles/container.admin",
+						"roles/storage.admin",
+					},
+				},
+				{
+					Level: "Project",
+					Roles: []string{
+						"roles/compute.admin",
+						"roles/container.admin",
+						"roles/iam.serviceAccountUser",
+					},
+				},
+			},
+			want: []*BlueprintRoles{
+				{
+					Level: "Project",
+					Roles: []string{
+						"roles/compute.admin",
+						"roles/container.admin",
+						"roles/iam.serviceAccountUser",
+					},
+				},
+				{
+					Level: "Project",
+					Roles: []string{
+						"roles/compute.admin",
+						"roles/container.admin",
+						"roles/storage.admin",
+					},
+				},
+			},
+		},
 	}
 
 	for _, tt := range tests {