fix(mint): GCP `--public` deploy should set PER_REPO_WIF_REPOS=* not ALLOWED_ORGS=*

[ifireball]

What happens

mint deploy --public on GCP (--platform=gcp, the default) sets ALLOWED_ORGS=* and leaves PER_REPO_WIF_REPOS unset. Dry-run and deploy summary text both describe public mode this way.

This contradicts ADR-0078: public mint mode is expressed as * in PER_REPO_WIF_REPOS, not * in ALLOWED_ORGS. ValidateWorkflowRef and AuthorizeToken key public-mode behavior off IsPublicMintRepos(perRepoWIFRepos).

Cloudflare deploy already does the right thing (--public → PER_REPO_WIF_REPOS=*). GCP provisioner (internal/dispatch/gcf/provisioner.go) and CLI messaging (internal/cli/mint.go) still use the legacy ALLOWED_ORGS=* path.

Observed on prod (2026-08-13): first deploy to it-gcp-konflux-prod-fullsend with --public produced revision fullsend-mint-00003-hhq with ALLOWED_ORGS=* and no PER_REPO_WIF_REPOS. Manual env correction (PER_REPO_WIF_REPOS=*, remove ALLOWED_ORGS) required a traffic shift to the new revision.

What should happen

GCP public mint deploy should match ADR-0078 and CF parity:

• Set PER_REPO_WIF_REPOS=*
• Leave ALLOWED_ORGS unset or empty (tight/org enrollment is a separate path; public mode has no org wildcard)
• Public-mode detection in GCP enroll/unenroll, per-repo registration, status, and mode-conversion guards should use IsPublicMintRepos, not IsPublicMint(ALLOWED_ORGS)
• CLI help, dry-run text, and deploy summary should describe PER_REPO_WIF_REPOS=*, not ALLOWED_ORGS=*

Existing GCP mints deployed with ALLOWED_ORGS=* need a documented migration path (set PER_REPO_WIF_REPOS=*, clear ALLOWED_ORGS).

How to reproduce

go run ./cmd/fullsend mint deploy \
  --project <GCP_PROJECT> \
  --region us-central1 \
  --public \
  --pem-dir <pem-dir> \
  --app-set fullsend-ai \
  --dry-run
# Summary says: "Would deploy public mint (ALLOWED_ORGS=*, permissive WIF)"

# After real deploy, inspect traffic-serving revision env:
gcloud run revisions describe <revision> --project <GCP_PROJECT> --region us-central1 \
  --format='yaml(spec.containers[0].env)' | rg 'ALLOWED_ORGS|PER_REPO_WIF_REPOS'
# ALLOWED_ORGS=* present; PER_REPO_WIF_REPOS absent

Context

• ADR-0078 migration note explicitly calls out that ALLOWED_ORGS=* without PER_REPO_WIF_REPOS=* changes workflow-ref validation behavior.
• CF enroll/unenroll was fixed in feat(#5633): add --platform=cloudflare to mint enroll/unenroll #6137 to use PER_REPO_WIF_REPOS for public-mode detection; GCP deploy path was not updated.
• Related epic: Epic: GCP/Cloudflare mint CLI and ops parity #6132 (GCP/CF CLI parity), but this is a correctness bug in GCP public-mode semantics, not just missing CF commands.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 7:27 PM UTC · Completed 7:30 PM UTC

Commit: 508dfe1 · View workflow run →

[fullsend-ai-triage]

Severity: high — all GCP public mint deploys produce incorrect authorization env vars, requiring manual correction.

Proposed test case

// TestGCPPublicDeployEnvVars verifies ADR-0078 compliance:
// - --public sets PER_REPO_WIF_REPOS=* (not ALLOWED_ORGS=*)
// - org-enrolled deploy does NOT set PER_REPO_WIF_REPOS=*
func TestGCPPublicDeployEnvVars(t *testing.T) {
    // Public mode: expect PER_REPO_WIF_REPOS=*
    env := buildGCPDeployEnv(publicMode: true)
    assert.Equal(t, "*", env["PER_REPO_WIF_REPOS"])
    assert.Empty(t, env["ALLOWED_ORGS"])

    // Org-enrolled mode: no PER_REPO_WIF_REPOS wildcard
    env = buildGCPDeployEnv(publicMode: false)
    assert.NotEqual(t, "*", env["PER_REPO_WIF_REPOS"])
}

// TestGCPDryRunPublicMessage verifies CLI messaging
func TestGCPDryRunPublicMessage(t *testing.T) {
    output := runDryDeploy("--public", "--platform=gcp")
    assert.Contains(t, output, "PER_REPO_WIF_REPOS=*")
    assert.NotContains(t, output, "ALLOWED_ORGS=*")
}

Related: part of epic #6132 (GCP/CF CLI parity). The Cloudflare path already implements the correct semantics.

---

Labels: This is a correctness bug in the mint component (GCP deploy path violates ADR-0078). Labeling as type/bug and component/mint with priority/high given prod impact.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 7:31 PM UTC · Completed 7:47 PM UTC

Commit: 508dfe1 · View workflow run →

[fullsend-ai-coder]

ℹ️ No PR created — agent determined no changes needed

The code agent ran and evaluated issue #6204, but did not produce changes to submit as a pull request.

Reason: No changed files in agent's commit(s)

Workflow run: https://github.com/fullsend-ai/.fullsend/actions/runs/31736204286

Retry with /fs-code if appropriate.