Merge pull request #6960 from fullsend-ai/agent/6958-wif-provider-repos-install

feat(#6958): add --inference-wif-provider to repos install, drop --inference-project-number

Author: ggallen

docs/cli/repos.md

@@ -110,7 +110,7 @@ When repos are specified as positional arguments, only those repos are processed
 | `--roles` | `triage,coder,review,fix,retro,prioritize` | Agent roles to install |
 | `--direct` | `false` | Push scaffold directly to default branch (skip PR) |
 | `--inference-project` | | GCP project ID for inference (written as `FULLSEND_GCP_PROJECT_ID` secret) |
-| `--inference-project-number` | | Numeric GCP project number for WIF provider computation (auto-derived from `--inference-project` when omitted) |
+| `--inference-wif-provider` | | Full WIF provider resource name (`projects/{number}/locations/global/workloadIdentityPools/{pool}/providers/{id}`); uses this provider for all repos instead of deriving per-repo providers. Project number is embedded in the path, so no auto-derivation is needed. |
 | `--forge` | | Forge type for new repos (`github` or `gitlab`). Required when adding repos not already in the manifest; inferred from existing platform sections when unambiguous. |
 | `--force` | `false` | Allow scaffold ref downgrades |
 | `--inference-region` | | Per-repo GCP inference region override (default: global when `--inference-project` is set; install-time only, not stored in the manifest) |

docs/guides/dev/cli-internals.md

@@ -68,7 +68,7 @@ fullsend
 │   │   ├── --roles <list>                   #   Agent roles (default: triage,coder,review,fix,retro,prioritize)
 │   │   ├── --direct                         #   Push scaffold to default branch (skip PR)
 │   │   ├── --inference-project <id>         #   GCP project ID for inference (install-time only)
-│   │   ├── --inference-project-number <num> #   Numeric GCP project number for WIF (auto-derived; install-time only)
+│   │   ├── --inference-wif-provider <path>  #   Full WIF provider resource name (uses verbatim; skips per-repo derivation)
 │   │   ├── --forge <type>                   #   Forge type for new repos (github or gitlab)
 │   │   ├── --inference-region <region>      #   Per-repo GCP inference region override
 │   │   ├── --fullsend-ref <ref>             #   Per-repo fullsend workflow ref override

internal/cli/repos.go

@@ -423,7 +423,8 @@ type reposInstallConfig struct {
 
 	// GCP credentials (install-time only)
 	inferenceProject       string
-	inferenceProjectNumber string
+	inferenceWIFProvider   string
+	inferenceProjectNumber string // auto-derived from --inference-project; not a CLI flag
 	inferenceRegion        string
 
 	// GitLab-specific
@@ -478,7 +479,7 @@ GCP infrastructure (WIF, mint) must be provisioned separately via
 	cmd.Flags().BoolVar(&opts.force, "force", false, "allow scaffold ref downgrades")
 	cmd.Flags().StringVar(&opts.forge, "forge", "", "forge type for repos not yet in the manifest (github or gitlab)")
 	cmd.Flags().StringVar(&opts.inferenceProject, "inference-project", "", "GCP project ID for inference")
-	cmd.Flags().StringVar(&opts.inferenceProjectNumber, "inference-project-number", "", "numeric GCP project number (auto-derived from --inference-project when omitted)")
+	cmd.Flags().StringVar(&opts.inferenceWIFProvider, "inference-wif-provider", "", "full WIF provider resource name (projects/{number}/locations/global/workloadIdentityPools/{pool}/providers/{id}); uses this provider for all repos instead of deriving per-repo providers")
 	cmd.Flags().StringVar(&opts.inferenceRegion, "inference-region", "", "GCP region for inference (default: global)")
 	cmd.Flags().StringVar(&opts.fullsendRef, "fullsend-ref", "", "per-repo fullsend workflow ref override")
 	cmd.Flags().StringVar(&opts.mintURL, "mint-url", "", "per-repo mint URL override")
@@ -496,8 +497,10 @@ func runReposInstall(ctx context.Context, opts *reposInstallConfig) error {
 	if opts.inferenceProject != "" && !repos.IsValidGCPProjectID(opts.inferenceProject) {
 		return fmt.Errorf("--inference-project %q is not a valid GCP project ID (must be 6-30 lowercase letters, digits, hyphens; start with a letter, no trailing hyphen)", opts.inferenceProject)
 	}
-	if opts.inferenceProjectNumber != "" && !repos.IsNumeric(opts.inferenceProjectNumber) {
-		return fmt.Errorf("--inference-project-number must be numeric, got %q", opts.inferenceProjectNumber)
+	if opts.inferenceWIFProvider != "" {
+		if err := validateWIFProvider(opts.inferenceWIFProvider); err != nil {
+			return err
+		}
 	}
 	if opts.forge != "" && !repos.IsValidForge(opts.forge) {
 		return fmt.Errorf("--forge: %q is not a valid forge platform (valid: %s, %s)", opts.forge, repos.ForgeGitHub, repos.ForgeGitLab)
@@ -520,9 +523,11 @@ func runReposInstall(ctx context.Context, opts *reposInstallConfig) error {
 		opts.inferenceRegion = "global"
 	}
 
-	// Derive --inference-project-number from --inference-project via
-	// the GCP Resource Manager API when not explicitly provided.
-	if opts.inferenceProject != "" && opts.inferenceProjectNumber == "" {
+	// When --inference-wif-provider is not set, derive the project number
+	// from --inference-project via the GCP Resource Manager API so that
+	// per-repo WIF provider paths can be constructed in converge.go.
+	// Skip when the project number is already populated (internal use).
+	if opts.inferenceProject != "" && opts.inferenceWIFProvider == "" && opts.inferenceProjectNumber == "" {
 		var projectNumber string
 		var lookupErr error
 		if opts.testProjectNumberFn != nil {
@@ -532,7 +537,7 @@ func runReposInstall(ctx context.Context, opts *reposInstallConfig) error {
 			projectNumber, lookupErr = gcpClient.GetProjectNumber(ctx, opts.inferenceProject)
 		}
 		if lookupErr != nil {
-			return fmt.Errorf("deriving project number from %q: %w (use --inference-project-number to specify it manually)", opts.inferenceProject, lookupErr)
+			return fmt.Errorf("deriving project number from %q: %w (use --inference-wif-provider to specify the full WIF provider path)", opts.inferenceProject, lookupErr)
 		}
 		opts.inferenceProjectNumber = projectNumber
 		printer.StepDone(fmt.Sprintf("Derived project number %s from project %s", projectNumber, opts.inferenceProject))
@@ -727,6 +732,7 @@ func runReposInstall(ctx context.Context, opts *reposInstallConfig) error {
 		InferenceProject:       opts.inferenceProject,
 		InferenceProjectNumber: opts.inferenceProjectNumber,
 		InferenceRegion:        opts.inferenceRegion,
+		WIFProvider:            opts.inferenceWIFProvider,
 		ReviewAppClientID:      reviewAppClientID,
 	}
 

internal/cli/repos_test.go

@@ -1156,12 +1156,18 @@ func TestReposInstallCmd_ForgeFlag(t *testing.T) {
 
 func TestReposInstallCmd_PerRepoOverrideFlags(t *testing.T) {
 	cmd := newReposInstallCmd()
-	for _, name := range []string{"inference-region", "fullsend-ref", "mint-url", "allowed-remote-resources"} {
+	for _, name := range []string{"inference-region", "inference-wif-provider", "fullsend-ref", "mint-url", "allowed-remote-resources"} {
 		f := cmd.Flags().Lookup(name)
 		require.NotNil(t, f, "expected --%s flag", name)
 	}
 }
 
+func TestReposInstallCmd_NoInferenceProjectNumberFlag(t *testing.T) {
+	cmd := newReposInstallCmd()
+	f := cmd.Flags().Lookup("inference-project-number")
+	assert.Nil(t, f, "--inference-project-number flag should be removed")
+}
+
 func TestRunReposInstall_AddsNewReposToManifest(t *testing.T) {
 	manifestPath := writeTestManifest(t, testManifestYAML)
 	fc := newInstallFakeClient("acme/api", "acme/web")
@@ -1383,16 +1389,16 @@ func TestRunReposInstall_InvalidInferenceProject(t *testing.T) {
 	assert.Contains(t, err.Error(), "--inference-project")
 }
 
-func TestRunReposInstall_InvalidInferenceProjectNumber(t *testing.T) {
+func TestRunReposInstall_InvalidInferenceWIFProvider(t *testing.T) {
 	manifestPath := writeTestManifest(t, testManifestYAML)
 	err := runReposInstall(context.Background(), &reposInstallConfig{
-		manifest:               manifestPath,
-		concurrency:            4,
-		inferenceProjectNumber: "not-a-number",
-		testClient:             newInstallFakeClient(),
+		manifest:             manifestPath,
+		concurrency:          4,
+		inferenceWIFProvider: "not-a-valid-provider",
+		testClient:           newInstallFakeClient(),
 	})
 	require.Error(t, err)
-	assert.Contains(t, err.Error(), "--inference-project-number must be numeric")
+	assert.Contains(t, err.Error(), "--inference-wif-provider")
 }
 
 func TestRunReposInstall_DerivesProjectNumber(t *testing.T) {
@@ -1429,28 +1435,27 @@ func TestRunReposInstall_DerivesProjectNumber(t *testing.T) {
 		"inference region should default to global")
 }
 
-func TestRunReposInstall_ExplicitProjectNumberSkipsLookup(t *testing.T) {
+func TestRunReposInstall_WIFProviderSkipsProjectNumberLookup(t *testing.T) {
 	manifestPath := writeTestManifest(t, testManifestYAML)
 	fc := newInstallFakeClient("acme/api")
 
 	lookupCalled := false
 	err := runReposInstall(context.Background(), &reposInstallConfig{
-		manifest:               manifestPath,
-		concurrency:            4,
-		roles:                  []string{"triage"},
-		direct:                 true,
-		inferenceProject:       "inf-proj",
-		inferenceProjectNumber: "111222333",
-		inferenceRegion:        "us-central1",
-		testClient:             fc,
+		manifest:             manifestPath,
+		concurrency:          4,
+		roles:                []string{"triage"},
+		direct:               true,
+		inferenceProject:     "inf-proj",
+		inferenceWIFProvider: "projects/123456789/locations/global/workloadIdentityPools/fullsend-inference/providers/github-oidc",
+		testClient:           fc,
 		testProjectNumberFn: func(_ context.Context, _ string) (string, error) {
 			lookupCalled = true
 			return "999", nil
 		},
 	})
 	require.NoError(t, err)
 	assert.False(t, lookupCalled,
-		"project number lookup should be skipped when --inference-project-number is explicit")
+		"project number lookup should be skipped when --inference-wif-provider is set")
 }
 
 func TestRunReposInstall_DefaultsInferenceRegion(t *testing.T) {
@@ -1493,7 +1498,7 @@ func TestRunReposInstall_ProjectNumberLookupError(t *testing.T) {
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "deriving project number")
 	assert.Contains(t, err.Error(), "API unavailable")
-	assert.Contains(t, err.Error(), "--inference-project-number")
+	assert.Contains(t, err.Error(), "--inference-wif-provider")
 }
 
 func TestRunReposInstall_PerRepoOverrideFlags_Applied(t *testing.T) {

internal/repos/converge.go

@@ -41,11 +41,18 @@ type ConvergeConfig struct {
 
 	// InferenceProject is the GCP project ID for inference.
 	InferenceProject string
-	// InferenceProjectNumber is the numeric GCP project number.
+	// InferenceProjectNumber is the numeric GCP project number,
+	// auto-derived from InferenceProject when WIFProvider is not set.
 	InferenceProjectNumber string
 	// InferenceRegion is the GCP region for inference.
 	InferenceRegion string
 
+	// WIFProvider, when set, is used as the WIF provider resource name
+	// for all repos instead of constructing per-repo provider IDs via
+	// BuildRepoProviderID. This supports org-scoped WIF providers
+	// (e.g., assertion.repository_owner == 'acme').
+	WIFProvider string
+
 	// ReviewAppClientID is the OAuth client ID of the review agent's
 	// GitHub App.
 	ReviewAppClientID string
@@ -222,34 +229,52 @@ func Converge(ctx context.Context, cfg ConvergeConfig,
 		return &ConvergeBatchResult{}, nil
 	}
 
-	// Validate inference flags.
-	inferenceFlags := []struct{ name, val string }{
-		{"--inference-project", cfg.InferenceProject},
-		{"--inference-project-number", cfg.InferenceProjectNumber},
-		{"--inference-region", cfg.InferenceRegion},
-	}
-	var inferenceSet, inferenceMissing []string
-	for _, f := range inferenceFlags {
-		if f.val != "" {
-			inferenceSet = append(inferenceSet, f.name)
-		} else {
-			inferenceMissing = append(inferenceMissing, f.name)
+	// Validate inference flags. When --inference-wif-provider is set,
+	// --inference-project-number is not required (the project number is
+	// embedded in the provider path).
+	if cfg.WIFProvider != "" {
+		// --inference-project and --inference-region are required
+		// alongside --inference-wif-provider because the secret-writing
+		// paths gate on InferenceProject to decide whether to write
+		// FULLSEND_GCP_PROJECT_ID and FULLSEND_GCP_WIF_PROVIDER.
+		if cfg.InferenceProject == "" {
+			return nil, fmt.Errorf("--inference-project is required when --inference-wif-provider is set")
 		}
-	}
-	if len(inferenceSet) > 0 && len(inferenceMissing) > 0 {
-		return nil, fmt.Errorf("incomplete inference flags: %s set but %s missing — all three are required when any is specified",
-			strings.Join(inferenceSet, ", "), strings.Join(inferenceMissing, ", "))
-	}
-
-	if cfg.InferenceProject != "" {
 		if !IsValidGCPProjectID(cfg.InferenceProject) {
 			return nil, fmt.Errorf("--inference-project %q is not a valid GCP project ID (must be 6-30 lowercase letters, digits, hyphens; start with a letter)", cfg.InferenceProject)
 		}
 		if !IsValidGCPRegion(cfg.InferenceRegion) {
 			return nil, fmt.Errorf("--inference-region %q is not a valid GCP region (must be lowercase letters, digits, hyphens; start with a letter)", cfg.InferenceRegion)
 		}
-		if !IsNumeric(cfg.InferenceProjectNumber) {
-			return nil, fmt.Errorf("--inference-project-number must be numeric, got %q", cfg.InferenceProjectNumber)
+	} else {
+		inferenceFlags := []struct{ name, val string }{
+			{"--inference-project", cfg.InferenceProject},
+			{"--inference-project-number", cfg.InferenceProjectNumber},
+			{"--inference-region", cfg.InferenceRegion},
+		}
+		var inferenceSet, inferenceMissing []string
+		for _, f := range inferenceFlags {
+			if f.val != "" {
+				inferenceSet = append(inferenceSet, f.name)
+			} else {
+				inferenceMissing = append(inferenceMissing, f.name)
+			}
+		}
+		if len(inferenceSet) > 0 && len(inferenceMissing) > 0 {
+			return nil, fmt.Errorf("incomplete inference flags: %s set but %s missing — all three are required when any is specified",
+				strings.Join(inferenceSet, ", "), strings.Join(inferenceMissing, ", "))
+		}
+
+		if cfg.InferenceProject != "" {
+			if !IsValidGCPProjectID(cfg.InferenceProject) {
+				return nil, fmt.Errorf("--inference-project %q is not a valid GCP project ID (must be 6-30 lowercase letters, digits, hyphens; start with a letter)", cfg.InferenceProject)
+			}
+			if !IsValidGCPRegion(cfg.InferenceRegion) {
+				return nil, fmt.Errorf("--inference-region %q is not a valid GCP region (must be lowercase letters, digits, hyphens; start with a letter)", cfg.InferenceRegion)
+			}
+			if !IsNumeric(cfg.InferenceProjectNumber) {
+				return nil, fmt.Errorf("--inference-project-number must be numeric, got %q", cfg.InferenceProjectNumber)
+			}
 		}
 	}
 
@@ -351,6 +376,10 @@ func Converge(ctx context.Context, cfg ConvergeConfig,
 		var wif string
 		if !hasSecrets {
 			switch {
+			case cfg.WIFProvider != "":
+				// Explicit WIF provider — use it verbatim for all repos.
+				// No per-repo derivation or collision check needed.
+				wif = cfg.WIFProvider
 			case d.resolved.Forge == ForgeGitHub && cfg.InferenceProjectNumber != "":
 				providerID := mintcore.BuildRepoProviderID(d.repo.Owner, d.repo.Repo)
 				wif = fmt.Sprintf("projects/%s/locations/global/workloadIdentityPools/%s/providers/%s",
@@ -378,7 +407,7 @@ func Converge(ctx context.Context, cfg ConvergeConfig,
 			}
 
 			// Validate inference flags for repos without existing secrets.
-			if cfg.InferenceProject == "" {
+			if cfg.InferenceProject == "" && cfg.WIFProvider == "" {
 				repoFullName := d.repo.Owner + "/" + d.repo.Repo
 				result.Results[i] = ConvergeResult{
 					Owner: d.repo.Owner,