fix(ci): add sleep between service enablement and resource creation

[haphungw]

To prevent flakes of services not enabled immediately after activation, I'm proposing to add a time_sleep delay of 60 seconds.

As noted in the Official Google Provider Guide, GCP APIs often return success at the global control plane before propagation to regional infrastructure is complete. This delay ensures resources like Firestore and KMS create successfully on the first run.

For reference, this pattern is also used in the official Google Cloud Datastore Module example, where they use a 120-second delay to make sure App Engine applications are initialized before creating indexes.

[dbolduc]

If I already have the service enabled, does it still sleep for 60 seconds?

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.74%. Comparing base (a2ccb22) to head (5fa7f31).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5444      +/-   ##
==========================================
- Coverage   97.74%   97.74%   -0.01%     
==========================================
  Files         216      216              
  Lines       47549    47549              
==========================================
- Hits        46478    46477       -1     
- Misses       1071     1072       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[haphungw]

Two trade-offs regarding this delay:

1. Wait time vs. Manual fix: Since setting up a personal project is usually a one-time operation, which causes more friction: an extra 60-second wait, or having to manually retry? (If we're okay with using Terraform as the standard, we just need wait and terraform apply again.)
2. Duration: I've set the delay to 60 seconds as a starting point. Some other modules use up to 120 seconds. Are we comfortable increasing this wait time?

If I already have the service enabled, does it still sleep for 60 seconds?

Yes if time_sleep is not recorded in the state file (local or remote).
Hmm this sounds like a big minus unless we all have an up to date Terraform state file.

[dbolduc]

Yes if time_sleep is not recorded in the state file (local or remote).

I am fine with this. It only gets added once.

[dbolduc]

Apparently we want to use triggers to have this sleep take affect when the services change. depends_on alone doesn't do that, it just controls the order of operations.

https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep#triggers-usage