fix(cli): sync inference org credentials on repo enrollment

Provision GCP secrets and region at org scope during install and
refresh selected-repository access on admin enable/disable, matching
FULLSEND_MINT_URL visibility for workflow_call dispatch from enrolled repos.

Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Barak Korren <bkorren@redhat.com>

Author: ifireball

internal/cli/admin.go

@@ -1681,7 +1681,7 @@ func runUninstall(ctx context.Context, client forge.Client, printer *ui.Printer,
 		layers.NewConfigRepoLayer(org, client, emptyCfg, printer, false),
 		layers.NewWorkflowsLayer(org, client, printer, ""),
 		layers.NewSecretsLayer(org, client, nil, printer),
-		layers.NewInferenceLayer(org, client, nil, printer),
+		layers.NewInferenceLayer(org, client, nil, nil, printer),
 		dispatchLayer,
 		layers.NewEnrollmentLayer(org, client, nil, nil, printer),
 	)
@@ -1848,7 +1848,7 @@ func buildLayerStack(
 		layers.NewWorkflowsLayer(org, client, printer, user),
 		layers.NewVendorBinaryLayer(org, forge.ConfigRepoName, client, printer, vendorBinary, vendorFn),
 		layers.NewSecretsLayer(org, client, agentCreds, printer).WithOIDCMode(),
-		layers.NewInferenceLayer(org, client, inferenceProvider, printer),
+		layers.NewInferenceLayer(org, client, inferenceProvider, enrolledRepoIDs, printer),
 		dispatchLayer,
 		layers.NewEnrollmentLayer(org, client, enabledRepos, disabledRepos, printer),
 	)
@@ -2256,12 +2256,9 @@ func runEnableRepos(ctx context.Context, client forge.Client, printer *ui.Printe
 		}
 	}
 
-	// Sync org variable visibility so enrolled repos can read dispatch
-	// variables like FULLSEND_MINT_URL. Runs even when changed == 0 to
-	// reconcile a previously failed best-effort sync on re-run.
-	if cfg.Dispatch.Mode == "oidc-mint" {
-		syncOrgVariableVisibility(ctx, client, printer, org, cfg, allOrgRepos)
-	}
+	// Sync org secret/variable visibility for enrolled repos. Runs even when
+	// changed == 0 to reconcile a previously failed best-effort sync on re-run.
+	syncEnrolledRepoCredentialVisibility(ctx, client, printer, org, cfg, allOrgRepos)
 
 	if changed == 0 {
 		return nil
@@ -2281,17 +2278,11 @@ func runEnableRepos(ctx context.Context, client forge.Client, printer *ui.Printe
 // dispatch layer, derived from the gcf provisioner to stay in sync automatically.
 var dispatchOrgVariableNames = gcf.NewProvisioner(gcf.Config{}, nil).OrgVariableNames()
 
-// syncOrgVariableVisibility updates the "selected" repository list for each
-// dispatch org variable so that all currently enrolled repos (plus the config
-// repo) can read them. This is best-effort: failures are logged as warnings
-// but do not fail the enable command, because the repo-maintenance workflow
-// can reconcile this later.
-func syncOrgVariableVisibility(ctx context.Context, client forge.Client, printer *ui.Printer, org string, cfg *config.OrgConfig, allOrgRepos []forge.Repository) {
-	// Collect IDs for all enabled repos.
+// enrolledRepoIDsForConfig returns GitHub repo IDs for all enabled repos plus
+// the .fullsend config repo (which needs access to org-scoped credentials).
+func enrolledRepoIDsForConfig(cfg *config.OrgConfig, allOrgRepos []forge.Repository) []int64 {
 	enrolledRepoIDs := collectEnrolledRepoIDs(allOrgRepos, cfg.EnabledRepos())
 
-	// Ensure the config repo (.fullsend) is included — it needs access
-	// to dispatch variables for its own workflows.
 	seen := make(map[int64]bool, len(enrolledRepoIDs))
 	for _, id := range enrolledRepoIDs {
 		seen[id] = true
@@ -2302,6 +2293,28 @@ func syncOrgVariableVisibility(ctx context.Context, client forge.Client, printer
 			break
 		}
 	}
+	return enrolledRepoIDs
+}
+
+// syncEnrolledRepoCredentialVisibility updates org-level dispatch variables and
+// inference secrets/variables so only currently enrolled repos (plus .fullsend)
+// can read them. Best-effort: failures are warnings, not command errors.
+func syncEnrolledRepoCredentialVisibility(ctx context.Context, client forge.Client, printer *ui.Printer, org string, cfg *config.OrgConfig, allOrgRepos []forge.Repository) {
+	if cfg.Dispatch.Mode == "oidc-mint" {
+		syncOrgVariableVisibility(ctx, client, printer, org, cfg, allOrgRepos)
+	}
+	if cfg.Inference.Provider != "" {
+		syncInferenceCredentialVisibility(ctx, client, printer, org, cfg, allOrgRepos)
+	}
+}
+
+// syncOrgVariableVisibility updates the "selected" repository list for each
+// dispatch org variable so that all currently enrolled repos (plus the config
+// repo) can read them. This is best-effort: failures are logged as warnings
+// but do not fail the enable command, because the repo-maintenance workflow
+// can reconcile this later.
+func syncOrgVariableVisibility(ctx context.Context, client forge.Client, printer *ui.Printer, org string, cfg *config.OrgConfig, allOrgRepos []forge.Repository) {
+	enrolledRepoIDs := enrolledRepoIDsForConfig(cfg, allOrgRepos)
 
 	for _, varName := range dispatchOrgVariableNames {
 		exists, checkErr := client.OrgVariableExists(ctx, org, varName)
@@ -2323,6 +2336,14 @@ func syncOrgVariableVisibility(ctx context.Context, client forge.Client, printer
 	}
 }
 
+// syncInferenceCredentialVisibility updates org-level inference secret and
+// variable visibility for enrolled repos. Best-effort like dispatch sync.
+func syncInferenceCredentialVisibility(ctx context.Context, client forge.Client, printer *ui.Printer, org string, cfg *config.OrgConfig, allOrgRepos []forge.Repository) {
+	repoIDs := enrolledRepoIDsForConfig(cfg, allOrgRepos)
+	layer := layers.NewInferenceLayer(org, client, nil, nil, printer)
+	layer.SyncEnrolledRepoAccess(ctx, repoIDs)
+}
+
 // runDisableRepos disables the specified repositories from fullsend enrollment.
 func runDisableRepos(ctx context.Context, client forge.Client, printer *ui.Printer, org string, repos []string, all bool, yolo bool) error {
 	printer.Banner(Version())
@@ -2416,14 +2437,12 @@ func runDisableRepos(ctx context.Context, client forge.Client, printer *ui.Print
 		return err
 	}
 
-	// Sync org variable visibility to revoke access for disabled repos.
-	if cfg.Dispatch.Mode == "oidc-mint" {
-		allOrgRepos, listErr := client.ListOrgRepos(ctx, org)
-		if listErr != nil {
-			printer.StepWarn(fmt.Sprintf("could not list org repos for variable sync: %v", listErr))
-		} else {
-			syncOrgVariableVisibility(ctx, client, printer, org, cfg, allOrgRepos)
-		}
+	// Sync org secret/variable visibility to revoke access for disabled repos.
+	allOrgRepos, listErr := client.ListOrgRepos(ctx, org)
+	if listErr != nil {
+		printer.StepWarn(fmt.Sprintf("could not list org repos for credential sync: %v", listErr))
+	} else {
+		syncEnrolledRepoCredentialVisibility(ctx, client, printer, org, cfg, allOrgRepos)
 	}
 
 	printer.Blank()

internal/cli/admin_test.go

@@ -810,6 +810,38 @@ func TestRunEnableRepos_VariableSyncErrorDoesNotBlockEnable(t *testing.T) {
 	require.NoError(t, err, "enable should succeed even when variable sync fails")
 }
 
+func TestRunEnableRepos_SyncsInferenceOrgSecretsWhenConfigured(t *testing.T) {
+	cfg := setupTestConfig(map[string]bool{
+		"web-app": false,
+		"api":     true,
+	})
+	cfg.Dispatch.Mode = "oidc-mint"
+	cfg.Inference.Provider = "vertex"
+
+	client := setupTestClient("testorg", cfg, []string{"web-app", "api"})
+	client.Repos[0].ID = 1
+	client.Repos[1].ID = 10
+	client.Repos[2].ID = 20
+	client.OrgSecrets = map[string]bool{
+		"testorg/FULLSEND_GCP_WIF_PROVIDER": true,
+		"testorg/FULLSEND_GCP_PROJECT_ID":   true,
+	}
+	client.OrgVariables = map[string]bool{"testorg/FULLSEND_GCP_REGION": true}
+	client.VariableValues["testorg/.fullsend/FULLSEND_GCP_REGION"] = "global"
+	client.VariablesExist["testorg/.fullsend/FULLSEND_GCP_REGION"] = true
+
+	printer := ui.New(&discardWriter{})
+
+	err := runEnableRepos(context.Background(), client, printer, "testorg", []string{"web-app"}, false, true)
+	require.NoError(t, err)
+
+	// Enabled repos: web-app + api + .fullsend
+	wantIDs := []int64{10, 20, 1}
+	assert.Equal(t, wantIDs, client.OrgSecretRepoIDs["testorg/FULLSEND_GCP_WIF_PROVIDER"])
+	assert.Equal(t, wantIDs, client.OrgSecretRepoIDs["testorg/FULLSEND_GCP_PROJECT_ID"])
+	assert.Equal(t, wantIDs, client.OrgVariableRepoIDs["testorg/FULLSEND_GCP_REGION"])
+}
+
 func TestRunEnableRepos_SkipsVariableSyncWhenVariableNotExists(t *testing.T) {
 	// When the org variable doesn't exist yet (mint not provisioned),
 	// sync should skip gracefully.
@@ -1197,7 +1229,7 @@ func TestCheckInstallScopes_SyncWithLayers(t *testing.T) {
 		layers.NewConfigRepoLayer("test-org", nil, emptyCfg, ui.New(&discardWriter{}), false),
 		layers.NewWorkflowsLayer("test-org", nil, ui.New(&discardWriter{}), ""),
 		layers.NewSecretsLayer("test-org", nil, nil, ui.New(&discardWriter{})),
-		layers.NewInferenceLayer("test-org", nil, nil, ui.New(&discardWriter{})),
+		layers.NewInferenceLayer("test-org", nil, nil, nil, ui.New(&discardWriter{})),
 		layers.NewOIDCDispatchLayer("test-org", nil, nil, nil, ui.New(&discardWriter{})),
 		layers.NewEnrollmentLayer("test-org", nil, nil, nil, ui.New(&discardWriter{})),
 		layers.NewVendorBinaryLayer("test-org", ".fullsend", nil, ui.New(&discardWriter{}), false, nil),