feat(#6811): add GCE-based GitLab runner provisioning scripts

[fullsend-ai-coder]

Summary

Add GCE-based GitLab runner provisioning scripts alongside the existing OpenShift Virtualization workflow. Rename existing scripts to disambiguate platforms.

Changes

• Rename create-vm.sh → create-openshift-vm.sh and delete-vm.sh → delete-openshift-vm.sh
• Add create-gcp-vm.sh — provisions a Fedora GCE VM (e2-standard-4, 20 GB pd-balanced, gitlab-runners VPC), registers a GitLab runner, copies setup files via gcloud compute scp, and runs setup.sh
• Add delete-gcp-vm.sh — deregisters the runner from GitLab and deletes the GCE instance
• Update README.md with separate quick-start sections for OpenShift and GCE, and platform-specific environment variable tables
• Update internal references in renamed scripts, vm.yaml, gitlab-runner-version.sh, and setup.sh comments
• setup.sh remains unchanged — it is platform-agnostic

Testing

• shellcheck passes on all new and renamed scripts
• YAML validation passes on vm.yaml
• Markdown link check passes via lychee
• No sensitive data (GCP project names, SA identifiers) hardcoded — all use environment variables
• setup.sh is unmodified (aside from comment references)
• Secret scan passes on all changed files

---

Closes #6811

Post-script verification

• Branch is not main/master (agent/6811-gce-runner-scripts)
• Secret scan passed (gitleaks — 2db46c4db0caacbd4f29284b4eeda72e6c01b2b2..HEAD)
• PR body secret scan passed (gitleaks — no-git)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Ended 6:23 PM UTC

Commit: 9b7714e · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:25 PM UTC · Completed 6:40 PM UTC

Commit: 3de3906 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $6.69

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Moderate risk, unchanged from prior assessment. The PR adds GCE provisioning scripts to hack/gitlab-runner-vm — an additive feature with no production code impact. The large blast radius score is the primary risk driver, but offset by changes confined to hack/ tooling scripts with no protected paths, no security-sensitive files, and no CI or dependency changes.

Previous run

Risk Assessment: moderate (2/5)

Details

Moderate risk. The PR adds GCE provisioning scripts to the hack/gitlab-runner-vm directory — an additive feature with no production code impact. The large blast radius score (from LINES_CHANGED near 800) is the primary risk driver, but this is offset by the fact that changes are confined to hack/ tooling scripts with no protected paths, no security-sensitive files, no CI workflow changes, and no dependency modifications. The directory has seen moderate recent churn with fix commits, but the PR is well-scoped to its issue and authored by a known bot.

[fullsend-ai-review]

Review

Findings

Low

• [SSH-MITM] hack/gitlab-runner-vm/create-gcp-vm.sh:89 — StrictHostKeyChecking=no and UserKnownHostsFile=/dev/null disable host key verification for all SSH/SCP connections to the GCE VM. Since gcloud compute ssh authenticates via GCP IAM (SSH keys are injected by the metadata service), the MITM risk is lower than raw SSH, and this is the standard pattern for ephemeral VMs. However, using gcloud's built-in host key management would be a defense-in-depth improvement.
  Remediation: Consider using gcloud compute ssh's built-in host key management (which stores keys in ~/.ssh/google_compute_known_hosts) instead of blanket-disabling host key checking.

• [error-handling] hack/gitlab-runner-vm/create-gcp-vm.sh:149 — The GITLAB_URL validation block does not call usage >&2 before exiting, unlike the GL_TOKEN, PROJECT_ID, and GCP_PROJECT blocks. This is a pre-existing inconsistency shared with the OpenShift script and affects only operator feedback quality.

• [code-duplication] hack/gitlab-runner-vm/create-gcp-vm.sh:97 — The gl_curl() function is copy-pasted identically across all four scripts (create-gcp-vm.sh, delete-gcp-vm.sh, create-openshift-vm.sh, delete-openshift-vm.sh). This is pre-existing duplication; four copies of a security-sensitive function (token handling) means a future fix must touch all four files.
  Remediation: Consider extracting gl_curl() into a shared helper sourced by all four scripts.

• [scope-coordination] — Issue Add GCE-based GitLab runner provisioning script #6811 notes that Convert gitlab-runner-vm scripts from project-scoped to group-scoped runners #6551 (group-scoped runners) modifies the same scripts. The renames in this PR will create merge conflicts with Convert gitlab-runner-vm scripts from project-scoped to group-scoped runners #6551 if it is based on the old filenames.
  Remediation: Ensure Convert gitlab-runner-vm scripts from project-scoped to group-scoped runners #6551 is rebased after this PR merges.

• [naming-consistency] hack/gitlab-runner-vm/create-gcp-vm.sh:319 — Runner description format diverges between platforms: OpenShift uses NAMESPACE/vm_name while GCE uses GCP_PROJECT/vm_name. This is intentional — the description serves as a lookup key in delete scripts, and each platform's delete script uses the corresponding identifier.

Previous run

Review

Findings

Medium

• [error-message-format] hack/gitlab-runner-vm/create-gcp-vm.sh:296 — The GCP_PROJECT validation error message does not call usage >&2 after printing the error, unlike the GL_TOKEN block (line 270) and PROJECT_ID block (line 280) which both call usage >&2 before exiting. This inconsistency within the same file means operators get different feedback quality depending on which required variable is missing.
  Remediation: Add usage >&2 after the GCP_PROJECT error message, consistent with the GL_TOKEN and PROJECT_ID blocks.

Low

• [SSH-MITM] hack/gitlab-runner-vm/create-gcp-vm.sh:226 — StrictHostKeyChecking=no and UserKnownHostsFile=/dev/null disable host key verification for all SSH/SCP connections to the GCE VM. Since gcloud compute ssh authenticates via GCP IAM (SSH keys are injected by the metadata service), the MITM risk is lower than raw SSH, and this is the standard pattern for ephemeral VMs. However, using gcloud's built-in host key management would be a defense-in-depth improvement.
  Remediation: Consider using gcloud compute ssh's built-in host key management (which stores keys in ~/.ssh/google_compute_known_hosts) instead of blanket-disabling host key checking.

• [commit-convention] PR title uses feat prefix for hack/ scripts. Per COMMITS.md, feat is for changes an end user would recognize as new capability. Since these scripts add support for a new platform target (GCE), feat is defensible — but chore could also fit for internal infrastructure tooling.

---

Labels: PR adds GCE runner provisioning scripts to hack/gitlab-runner-vm/

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 6:42 PM UTC · Completed 6:47 PM UTC

Commit: 3de3906 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.14

[fullsend-ai-coder]

🔧 Fix agent — iteration 1 (bot-triggered)

Fixed the GCP_PROJECT validation block to include usage >&2 after the error message, matching GL_TOKEN and PROJECT_ID patterns. Disagreed with the SSH host key suggestion (defense-in-depth improvement for a separate PR) and the commit convention observation (not actionable, reviewer considers feat defensible).

Fixed (1):

1. GCP_PROJECT validation error message does not call usage after printing the error, unlike GL_TOKEN and PROJECT_ID blocks (hack/gitlab-runner-vm/create-gcp-vm.sh): Added usage >&2 to the GCP_PROJECT validation block, matching the pattern used by GL_TOKEN and PROJECT_ID blocks so operators get consistent feedback

Disagreed (2):

1. StrictHostKeyChecking=no and UserKnownHostsFile=/dev/null disable host key verification for SSH/SCP connections: The reviewer explicitly acknowledges the MITM risk is lower because gcloud compute ssh authenticates via GCP IAM, and uses 'Consider' language. Disabling host key checking is the standard pattern for ephemeral GCE VMs — first-boot always has unknown keys, and VMs are destroyed/recreated frequently. Switching to gcloud's built-in host key management would add complexity around key lifecycle without meaningful security benefit for ephemeral infrastructure. This is a defense-in-depth improvement better suited for a separate PR.
2. PR title uses feat prefix for hack/ scripts; chore could also fit: Not actionable by the fix agent (PR title changes are outside scope). The reviewer already considers feat defensible since the scripts add support for a new platform target (GCE). No code change needed.

Tests: passed

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:49 PM UTC · Completed 7:04 PM UTC

Commit: 2be1d8f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $5.60

Superseded by updated review