refactor(repos): extract per-repo install logic into internal/repos package

Move the core per-repo installation flow (guard check, WIF provisioning,
scaffold commit, variable/secret writes) from internal/cli/admin.go into
a reusable internal/repos package. This enables the future `fullsend
repos install` command (ADR 0057) to share the same logic without
duplicating the admin CLI's implementation.

The refactored Install() function accepts an InstallConfig struct and
a WIFProvisioner interface, decoupling the install logic from CLI
concerns (spinners, prompts, flag parsing) and from the concrete GCF
provisioner. admin.go delegates to repos.Install() via a gcfWIFAdapter
that bridges the gcf.Provisioner to the WIFProvisioner interface.

Test coverage on the new package is 89.2% (17 tests covering fresh
install, guard check, WIF provisioning/failure, scaffold commit/failure,
mint discovery, and PR-based delivery).

Signed-off-by: Greg Allen <gallen@redhat.com>
Signed-off-by: Claude <noreply@anthropic.com>
Signed-off-by: Greg Allen <gallen@redhat.com>

Author: ggallen

internal/cli/admin.go

@@ -29,6 +29,7 @@ import (
 	"github.com/fullsend-ai/fullsend/internal/inference/vertex"
 	"github.com/fullsend-ai/fullsend/internal/layers"
 	"github.com/fullsend-ai/fullsend/internal/mintcore"
+	"github.com/fullsend-ai/fullsend/internal/repos"
 	"github.com/fullsend-ai/fullsend/internal/scaffold"
 	"github.com/fullsend-ai/fullsend/internal/ui"
 )
@@ -970,46 +971,104 @@ func runPerRepoInstall(ctx context.Context, c perRepoInstallConfig) error {
 		printer.StepDone("Mint validated and org registered")
 	}
 
+	// Delegate WIF provisioning, scaffold commit, and variable/secret
+	// writes to the reusable repos.Install function. This enables the
+	// future `fullsend repos install` command to share the same logic.
+	var wifProv repos.WIFProvisioner
 	if needsWIFProvision {
-		printer.StepStart("Provisioning WIF infrastructure")
-		provisioner := gcf.NewProvisioner(gcf.Config{
-			ProjectID:   inferenceProject,
-			GitHubOrgs:  []string{owner},
-			Repo:        owner + "/" + repo,
-			WIFPoolName: gcf.DefaultInferencePool,
-		}, gcf.NewLiveGCFClient(inferenceProject))
-		var provErr error
-		inferenceWIFProvider, provErr = provisioner.ProvisionWIF(ctx)
-		if provErr != nil {
-			printer.StepFail("WIF provisioning failed")
-			return fmt.Errorf("provisioning WIF: %w", provErr)
+		wifProv = &gcfWIFAdapter{
+			wifProvisioner: gcf.NewProvisioner(gcf.Config{
+				ProjectID:   inferenceProject,
+				GitHubOrgs:  []string{owner},
+				Repo:        owner + "/" + repo,
+				WIFPoolName: gcf.DefaultInferencePool,
+			}, gcf.NewLiveGCFClient(inferenceProject)),
+		}
+	}
+
+	installCfg := repos.InstallConfig{
+		Owner:            owner,
+		Repo:             repo,
+		Roles:            roles,
+		MintURL:          mintURL,
+		InferenceProject: inferenceProject,
+		InferenceRegion:  inferenceRegion,
+		UpstreamRef:      upstreamRef,
+		UpstreamTag:      upstreamTag,
+		SkipMintCheck:    true, // already handled above
+		SkipAppSetup:     true, // already handled above
+		SkipGuardCheck:   true, // admin.go handles guard check itself (lines 691-704)
+		SkipWIF:          !needsWIFProvision,
+		WIFProvider:      inferenceWIFProvider,
+		VendorBinary:     vendor,
+		Direct:           c.Direct,
+	}
+
+	progressFn := func(_ string, phase, msg string) {
+		switch phase {
+		case "wif":
+			if strings.Contains(msg, "Provisioning") {
+				printer.StepStart(msg)
+			} else if strings.Contains(msg, "ready") {
+				printer.StepDone(msg)
+				printer.StepInfo("IAM policy changes may take up to 7 minutes to propagate")
+				printer.StepInfo("Agent workflows that authenticate via WIF may fail until propagation completes")
+			}
+		case "scaffold":
+			if strings.Contains(msg, "Committing") || strings.Contains(msg, "Generating") {
+				printer.StepStart(msg)
+			} else {
+				printer.StepDone(msg)
+			}
+		case "vars":
+			if strings.Contains(msg, "Configuring") {
+				printer.StepStart(msg)
+			} else {
+				printer.StepDone(msg)
+			}
+		case "secrets":
+			if strings.Contains(msg, "Configuring") {
+				printer.StepStart(msg)
+			} else {
+				printer.StepDone(msg)
+			}
 		}
-		printer.StepDone("WIF infrastructure ready")
-		printer.StepInfo("IAM policy changes may take up to 7 minutes to propagate")
-		printer.StepInfo("Agent workflows that authenticate via WIF may fail until propagation completes")
 	}
 
-	repoVars := map[string]string{
-		"FULLSEND_MINT_URL":   mintURL,
-		"FULLSEND_GCP_REGION": inferenceRegion,
-		forge.PerRepoGuardVar: "true",
+	installResult, installErr := repos.Install(ctx, installCfg, client, wifProv, progressFn)
+	if installErr != nil {
+		return installErr
 	}
 
-	repoSecrets := map[string]string{
-		"FULLSEND_GCP_PROJECT_ID":   inferenceProject,
-		"FULLSEND_GCP_WIF_PROVIDER": inferenceWIFProvider,
+	if installResult.WIFProvider != "" {
+		inferenceWIFProvider = installResult.WIFProvider
 	}
 
 	if vendor {
 		var vendorErr error
+		scaffoldFiles, buildErr := repos.BuildScaffoldFiles(installCfg)
+		if buildErr != nil {
+			return fmt.Errorf("building scaffold files for vendor: %w", buildErr)
+		}
+		files = scaffoldFiles
 		files, _, vendorErr = appendVendorTreeFiles(printer, owner, repo, files, vendor, fullsendBinary, fullsendSource)
 		if vendorErr != nil {
 			return fmt.Errorf("collecting vendored assets: %w", vendorErr)
 		}
-	}
-
-	if err := applyPerRepoScaffold(ctx, client, printer, owner, repo, files, repoVars, repoSecrets, c.Direct); err != nil {
-		return err
+		// Vendor files need a separate commit since they weren't included
+		// in the repos.Install scaffold commit.
+		repoVars := map[string]string{
+			"FULLSEND_MINT_URL":   mintURL,
+			"FULLSEND_GCP_REGION": inferenceRegion,
+			forge.PerRepoGuardVar: "true",
+		}
+		repoSecrets := map[string]string{
+			"FULLSEND_GCP_PROJECT_ID":   inferenceProject,
+			"FULLSEND_GCP_WIF_PROVIDER": inferenceWIFProvider,
+		}
+		if err := applyPerRepoScaffold(ctx, client, printer, owner, repo, files, repoVars, repoSecrets, c.Direct); err != nil {
+			return err
+		}
 	}
 
 	if !vendor {
@@ -1023,6 +1082,56 @@ func runPerRepoInstall(ctx context.Context, c perRepoInstallConfig) error {
 	return nil
 }
 
+// gcfWIFAdapter wraps a gcf.Provisioner to implement repos.WIFProvisioner.
+type gcfWIFAdapter struct {
+	discoverer     *gcf.Provisioner
+	wifProvisioner *gcf.Provisioner
+}
+
+func (a *gcfWIFAdapter) DiscoverMint(ctx context.Context) (*repos.MintDiscovery, error) {
+	prov := a.discoverer
+	if prov == nil {
+		return nil, repos.ErrMintNotFound
+	}
+	d, err := prov.DiscoverMint(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return &repos.MintDiscovery{
+		URL:             d.URL,
+		RoleAppIDs:      d.RoleAppIDs,
+		PerRepoWIFRepos: d.PerRepoWIFRepos,
+	}, nil
+}
+
+func (a *gcfWIFAdapter) ProvisionWIF(ctx context.Context) (string, error) {
+	if a.wifProvisioner == nil {
+		return "", fmt.Errorf("WIF provisioner not configured")
+	}
+	return a.wifProvisioner.ProvisionWIF(ctx)
+}
+
+func (a *gcfWIFAdapter) RegisterPerRepoWIF(ctx context.Context, repo string) error {
+	if a.wifProvisioner == nil {
+		return fmt.Errorf("WIF provisioner not configured")
+	}
+	return a.wifProvisioner.RegisterPerRepoWIF(ctx, repo)
+}
+
+func (a *gcfWIFAdapter) EnsureOrgInMint(ctx context.Context, expectedURL string, org string) error {
+	if a.wifProvisioner == nil {
+		return fmt.Errorf("WIF provisioner not configured")
+	}
+	return a.wifProvisioner.EnsureOrgInMint(ctx, expectedURL, org)
+}
+
+func (a *gcfWIFAdapter) DeletePerRepoWIF(ctx context.Context, repo string) error {
+	if a.wifProvisioner == nil {
+		return fmt.Errorf("WIF provisioner not configured")
+	}
+	return a.wifProvisioner.RemoveRepoFromMint(ctx, repo)
+}
+
 // applyPerRepoScaffold commits scaffold files to the repo's default branch
 // and configures the repository variables and secrets needed for fullsend.
 func applyPerRepoScaffold(ctx context.Context, client forge.Client, printer *ui.Printer,