Rename GCP CLI flags to provider-agnostic inference flags and auto-provision WIF

[waynesun09]

Problem

The current --gcp-project, --gcp-region, and --gcp-wif-provider flags are only used for inference (Vertex AI), but their names suggest general GCP usage, which is confusing alongside --mint-project. Additionally, --gcp-wif-provider requires the user to manually look up and pass the full WIF provider resource name, and --gcp-region has no default despite global being the standard choice.

Proposed changes

1. Rename flags to provider-agnostic names

Current	Proposed
--gcp-project	--inference-project
--gcp-region	--inference-region
--gcp-wif-provider	--inference-wif-provider

2. Default --inference-region to global

Only --inference-project should be required to enable inference. Region defaults to global.

3. Auto-discover or create WIF provider

When --inference-wif-provider is not provided but --inference-project is:

1. List WIF pools/providers in the project for one with an assertion.repository == '{org}/.fullsend' attribute condition
2. If found, use that provider's resource name
3. If not found, create the pool + provider (reuse logic from the mint provisioner)

--inference-wif-provider remains as an optional override for custom WIF setups.

4. Minimal inference setup

After these changes, enabling inference requires only:

fullsend admin install "$ORG" \
  --inference-project "$GCP_PROJECT" \
  --mint-project "$GCP_PROJECT"

[github-actions]

fullsend triage is working on this — view logs

[fullsend-ai-triage]

Triage Summary

Category: Enhancement · Severity: Medium

Problem

The current --gcp-project, --gcp-region, and --gcp-wif-provider flags are scoped to inference (Vertex AI) but their naming implies general GCP usage, creating confusion alongside --mint-project. Additionally, --gcp-region lacks a default and --gcp-wif-provider requires manual resource name lookup.

Recommended Approach

1. Rename flags in internal/cli/admin.go (lines ~290-294) and update all validation logic (lines ~158-184):

   • --gcp-project → --inference-project
   • --gcp-region → --inference-region
   • --gcp-wif-provider → --inference-wif-provider

2. Default --inference-region to global — remove the current validation requiring it when --inference-project is set.

3. Auto-discover/create WIF provider — reuse the WIF pool/provider creation patterns from internal/dispatch/gcf/provisioner.go (pool creation at ~line 321, provider creation at ~line 357, attribute condition building at ~line 576). When --inference-project is provided without --inference-wif-provider, list existing providers and match on attribute condition, or create a new pool+provider.

4. Update downstream references in internal/inference/vertex/vertex.go and any documentation.

Proposed Test Case

- Verify renamed flags (--inference-project, --inference-region, --inference-wif-provider) are accepted
- Verify old flag names (--gcp-project, etc.) are no longer accepted
- Verify --inference-region defaults to "global" when omitted
- Mock GCP API: return an existing WIF pool/provider matching the org's
  attribute condition → verify auto-discovery selects it
- Mock GCP API: return no matching pool/provider → verify auto-creation
  calls CreateWIFPool and CreateWIFProvider with correct parameters
- Verify --inference-wif-provider as explicit override bypasses auto-discovery

This issue is well-specified and ready for implementation.

[fullsend-ai-triage]

Meeting update — 2026-05-13

Relevant to this issue: The team discussed simplifying installation parameters by integrating directly with Workload Identity Federation, removing the need for users to provide service account credentials. The Mint service was confirmed as mandatory for deploying secrets via Google Cloud.

• Decision: prioritize direct WIF integration to simplify the install flow
• Service account requirements should be removed from the user-facing install path
• The Mint ADR has been updated and is pending merge

Related PRs: #862 — fix: sync org variable visibility when enabling repos

Next steps: Review and merge the updated Mint ADR. Run uninstall to clean up the existing environment before re-testing the simplified flow.

Meeting notes