refactor: extract mintcore shared library from GCP mint

Extract shared types, validation, and GitHub API helpers from the
monolithic mint Cloud Function into a reusable mintcore module. The GCP
mint now imports mintcore for claims validation, JWT generation, and
installation token creation.

Signed-off-by: Greg Allen <gallen@redhat.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ggallen

CLAUDE.md

@@ -22,6 +22,8 @@ Fullsend is a platform for fully autonomous agentic development for GitHub-hoste
 
 When changing `internal/mint/main.go`, always copy it to `internal/dispatch/gcf/mintsrc/main.go.embed`. If `go.mod` or `go.sum` changed, sync those to `go.mod.embed` and `go.sum.embed` too.
 
+The `internal/mintcore/` module is shared between the mint and devmint. Its files are also embedded for Cloud Function deployment at `internal/dispatch/gcf/mintsrc/mintcore/*.embed`. When changing any file in `internal/mintcore/`, sync it to the corresponding `.embed` file under `mintsrc/mintcore/`. Note: the mint's `go.mod.embed` uses `replace mintcore => ./mintcore` (not `../mintcore`), because `provisioner.go` rewrites the replace directive at bundle time to match the deployed directory layout.
+
 **Forge abstraction:** All git forge operations must go through the `forge.Client` interface in `internal/forge/forge.go`. Do not use `exec.Command("gh", ...)` or direct GitHub API calls outside `internal/forge/github/`. See [AGENTS.md](AGENTS.md#forge-abstraction) for details.
 
 When making changes to Go code under `cmd/` or `internal/`:

docs/guides/infrastructure/infrastructure-reference.md

@@ -63,7 +63,7 @@ The mint is a GCP Cloud Function that exchanges GitHub OIDC tokens for scoped Gi
 │  │  6. Create Scoped Installation Token              │           │
 │  │     ├─ POST /installations/{id}/access_tokens     │           │
 │  │     ├─ Scope to requested repos[]                 │           │
-│  │     └─ Apply rolePermissions minimum set          │           │
+│  │     └─ Apply RolePermissions() minimum set         │           │
 │  │                                                   │           │
 │  └──────────┬───────────────────────────────────────┘           │
 │             │                                                   │
@@ -102,6 +102,19 @@ A single mint instance can serve multiple orgs:
 - `ROLE_APP_IDS` maps `{org}/{role}` to GitHub App IDs
 - Updates are applied atomically by redeploying the function with updated env vars
 
+### Status Endpoint
+
+`GET /v1/status` returns the configured roles available for the authenticated caller's org.
+
+- **Authentication:** Bearer OIDC JWT (same as `/v1/token`)
+- **Authorization:** Any valid OIDC token from an allowed org — no role restriction
+- **Response:**
+  ```json
+  {"org": "my-org", "roles": ["coder", "review", "triage"]}
+  ```
+- **Use case:** Workflow diagnostics — discover which roles are available before requesting a token
+- **Security:** Returns only the requesting org and its role names (not app IDs, not other orgs' roles)
+
 ---
 
 ## Inference — Agent Platform with Workload Identity Federation

go.mod

@@ -11,7 +11,6 @@ require (
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/crypto v0.50.0
-	golang.org/x/net v0.52.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/term v0.42.0
 	golang.org/x/text v0.36.0
@@ -32,6 +31,7 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/deckarep/golang-set/v2 v2.8.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/fullsend-ai/fullsend/internal/mintcore v0.0.0
 	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-jose/go-jose/v3 v3.0.5 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
@@ -63,3 +63,5 @@ require (
 	google.golang.org/protobuf v1.36.11 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
 )
+
+replace github.com/fullsend-ai/fullsend/internal/mintcore => ./internal/mintcore

go.sum

@@ -144,8 +144,6 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

internal/cli/admin.go

@@ -22,6 +22,7 @@ import (
 	"github.com/fullsend-ai/fullsend/internal/config"
 	"github.com/fullsend-ai/fullsend/internal/dispatch"
 	"github.com/fullsend-ai/fullsend/internal/dispatch/gcf"
+	"github.com/fullsend-ai/fullsend/internal/mintcore"
 	"github.com/fullsend-ai/fullsend/internal/forge"
 	gh "github.com/fullsend-ai/fullsend/internal/forge/github"
 	"github.com/fullsend-ai/fullsend/internal/inference"
@@ -792,7 +793,7 @@ func runPerRepoInstall(ctx context.Context, c perRepoInstallConfig) error {
 			printer.StepInfo("Would provision WIF infrastructure in GCP project " + inferenceProject)
 			printer.StepInfo(fmt.Sprintf("  Service account: fullsend-mint@%s.iam.gserviceaccount.com", inferenceProject))
 			printer.StepInfo("  WIF pool: " + gcf.DefaultInferencePool)
-			printer.StepInfo(fmt.Sprintf("  WIF provider: %s", gcf.BuildRepoProviderID(owner, repo)))
+			printer.StepInfo(fmt.Sprintf("  WIF provider: %s", mintcore.BuildRepoProviderID(owner, repo)))
 			printer.StepInfo(fmt.Sprintf("  Repo restriction: %s/%s", owner, repo))
 			printer.Blank()
 		}

internal/cli/inference.go

@@ -9,6 +9,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/fullsend-ai/fullsend/internal/dispatch/gcf"
+	"github.com/fullsend-ai/fullsend/internal/mintcore"
 	"github.com/fullsend-ai/fullsend/internal/ui"
 )
 
@@ -135,7 +136,7 @@ func runInferenceProvisionDryRun(cmd *cobra.Command, printer *ui.Printer, org, r
 		printer.Blank()
 		printer.StepInfo(fmt.Sprintf("Repository:   %s", repo))
 		parts := strings.SplitN(repo, "/", 2)
-		providerID := gcf.BuildRepoProviderID(parts[0], parts[1])
+		providerID := mintcore.BuildRepoProviderID(parts[0], parts[1])
 		printer.StepInfo(fmt.Sprintf("WIF provider: %s (repo-scoped)", providerID))
 		printer.StepInfo(fmt.Sprintf("Condition:    assertion.repository == '%s'", strings.ToLower(repo)))
 	} else {
@@ -285,7 +286,7 @@ func runInferenceStatus(cmd *cobra.Command, org, repo, project, pool, provider,
 	providerName := provider
 	if repo != "" {
 		parts := strings.SplitN(repo, "/", 2)
-		providerName = gcf.BuildRepoProviderID(parts[0], parts[1])
+		providerName = mintcore.BuildRepoProviderID(parts[0], parts[1])
 	}
 
 	result := &inferenceStatusResult{
@@ -505,7 +506,7 @@ func runInferenceDeprovisionDryRun(printer *ui.Printer, org, repo, project, pool
 		printer.Header("Dry run: deprovision repo " + repo + " from inference")
 		printer.Blank()
 		parts := strings.SplitN(repo, "/", 2)
-		providerID := gcf.BuildRepoProviderID(parts[0], parts[1])
+		providerID := mintcore.BuildRepoProviderID(parts[0], parts[1])
 		printer.StepInfo(fmt.Sprintf("Repository:   %s", repo))
 		printer.StepInfo(fmt.Sprintf("GCP project:  %s", project))
 		printer.StepInfo(fmt.Sprintf("WIF pool:     %s", pool))
@@ -543,7 +544,7 @@ func runInferenceDeprovision(cmd *cobra.Command, printer *ui.Printer, org, repo,
 		printer.Blank()
 
 		parts := strings.SplitN(repo, "/", 2)
-		providerID := gcf.BuildRepoProviderID(parts[0], parts[1])
+		providerID := mintcore.BuildRepoProviderID(parts[0], parts[1])
 
 		provisioner := gcf.NewProvisioner(gcf.Config{
 			ProjectID:   project,

internal/cli/mint.go

@@ -28,6 +28,7 @@ import (
 	"github.com/fullsend-ai/fullsend/internal/appsetup"
 	"github.com/fullsend-ai/fullsend/internal/config"
 	"github.com/fullsend-ai/fullsend/internal/dispatch/gcf"
+	"github.com/fullsend-ai/fullsend/internal/mintcore"
 	"github.com/fullsend-ai/fullsend/internal/ui"
 )
 
@@ -697,7 +698,7 @@ func runMintEnrollRepo(ctx context.Context, printer *ui.Printer, repoFullName, p
 		printer.StepInfo(fmt.Sprintf("  Would add %s to ALLOWED_ORGS", owner))
 		printer.StepInfo(fmt.Sprintf("  Would copy PEMs from %s for %d roles", appSet, len(roleList)))
 		printer.StepInfo(fmt.Sprintf("  Would add %s to PER_REPO_WIF_REPOS", repoFullName))
-		printer.StepInfo(fmt.Sprintf("  Would create WIF provider: %s", gcf.BuildRepoProviderID(owner, repo)))
+		printer.StepInfo(fmt.Sprintf("  Would create WIF provider: %s", mintcore.BuildRepoProviderID(owner, repo)))
 		return nil
 	}
 
@@ -1078,7 +1079,7 @@ func runMintUnenrollRepo(ctx context.Context, printer *ui.Printer, repoFullName,
 	printer.StepDone("Mint verified")
 
 	if dryRun {
-		providerID := gcf.BuildRepoProviderID(owner, repo)
+		providerID := mintcore.BuildRepoProviderID(owner, repo)
 		printer.Blank()
 		printer.StepInfo("Dry run — no changes will be made")
 		printer.Blank()
@@ -1110,7 +1111,7 @@ func runMintUnenrollRepo(ctx context.Context, printer *ui.Printer, repoFullName,
 	printer.StepDone("Repo removed from PER_REPO_WIF_REPOS")
 
 	// Step 2: Disable or delete WIF provider.
-	providerID := gcf.BuildRepoProviderID(owner, repo)
+	providerID := mintcore.BuildRepoProviderID(owner, repo)
 	if deleteProvider {
 		printer.StepStart("Deleting WIF provider " + providerID)
 		if err := provisioner.DeleteWIFProvider(ctx, providerID); err != nil {

internal/dispatch/gcf/mintsrc/go.mod.embed

@@ -2,7 +2,10 @@ module github.com/fullsend-ai/fullsend/internal/mint
 
 go 1.26
 
-require github.com/GoogleCloudPlatform/functions-framework-go v1.9.0
+require (
+	github.com/GoogleCloudPlatform/functions-framework-go v1.9.0
+	github.com/fullsend-ai/fullsend/internal/mintcore v0.0.0
+)
 
 require (
 	github.com/cloudevents/sdk-go/v2 v2.15.2 // indirect
@@ -13,4 +16,7 @@ require (
 	go.uber.org/atomic v1.4.0 // indirect
 	go.uber.org/multierr v1.1.0 // indirect
 	go.uber.org/zap v1.10.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
 )
+
+replace github.com/fullsend-ai/fullsend/internal/mintcore => ./mintcore

internal/dispatch/gcf/mintsrc/go.sum.embed

@@ -22,8 +22,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 go.uber.org/atomic v1.4.0 h1:cxzIVoETapQEqDhQu3QfnvXAV4AlzcvUCxkVUFw3+EU=
@@ -32,6 +32,8 @@ go.uber.org/multierr v1.1.0 h1:HoEmRHQPVSqub6w2z2d2EOVs2fjyFRGyofhKuyDq0QI=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/zap v1.10.0 h1:ORx85nbTijNz8ljznvCMR1ZBIPKFn3jQrag10X2AsuM=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac h1:7zkz7BUtwNFFqcowJ+RIgu2MaV/MapERkDIy+mwPyjs=
 golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=