feat(cli): add inference sub-command for standalone WIF provisioning

[waynesun09]

Summary

• Adds fullsend inference sub-command tree with 2 commands: provision and status
• Extracts inference WIF provisioning from the monolithic admin install so GCP admins can provision Vertex AI WIF infrastructure without needing GitHub credentials
• provision creates WIF pool/provider and prints the resource name for handoff to fullsend admin install
• status combines health check + config display with --format support (text/json/env)

Test plan

• go test ./internal/cli/... passes (28 tests)
• go vet ./internal/cli/... clean
• Verify fullsend inference --help shows both sub-commands
• Verify fullsend inference provision --help shows all flags
• Verify fullsend inference status --help shows --format flag
• Verify no GitHub token is required for either command
• E2E: fullsend inference provision <org> --project=<proj> creates WIF infra and prints provider name
• E2E: fullsend inference status <org> --project=<proj> --format=env prints config values

[github-actions]

Site preview

Preview: https://75e7eef8-site.fullsend-ai.workers.dev

Commit: 18b20c89a8ca5a4809c49f70ad33424d8107c074

[fullsend-ai-review]

Review

Findings

Low

• [documentation-currency] docs/guides/dev/cli-internals.md:7 — The CLI command tree does not include the new inference subcommand with its provision and status children. Developers consulting this doc for the full command surface will not see the new commands. The CLI --help output is correct, but the doc should be updated for completeness.
  Remediation: Add inference (with provision and status children) to the command tree in docs/guides/dev/cli-internals.md between admin and run.

Previous run

Review

Findings

Low

• [documentation-currency] docs/guides/dev/cli-internals.md:5-25 — The CLI Command Tree diagram does not include the new inference subcommand tree (inference, provision, status). This diagram is the canonical reference for the CLI structure and should be updated to reflect the new commands.
  Remediation: Add the inference subtree to the command tree diagram between admin and run.

Info

• [style] internal/cli/inference.go:339 — formatStatusJSON mixes domain keys (FULLSEND_GCP_PROJECT_ID, FULLSEND_GCP_WIF_PROVIDER) with metadata keys (status, details) in a map[string]interface{}. A dedicated struct would make the JSON contract more explicit and prevent accidental key collisions. Not blocking — the current approach works.

Previous run (2)

Review

Findings

Low

• [documentation-currency] docs/guides/dev/cli-internals.md:7-25 — The CLI Command Tree diagram does not include the new inference subcommand tree (inference, provision, status). This diagram is the canonical reference for the CLI structure and should be updated to reflect the new commands.
  Remediation: Add the inference subtree to the command tree diagram between admin and run.

Info

• [style] internal/cli/inference.go:339 — formatStatusJSON mixes domain keys (FULLSEND_GCP_PROJECT_ID, FULLSEND_GCP_WIF_PROVIDER) with metadata keys (status, details) in a map[string]interface{}. A dedicated struct would make the JSON contract more explicit and prevent accidental key collisions. Not blocking — the current approach works.

Previous run (3)

Review

Findings

Medium

• [correctness] internal/cli/inference.go:64 — The --region flag (line 100) is documented as "WIF location (default: global)" but the value is never passed to gcf.Config in runInferenceProvisionWIF (line 155). WIF pools are always created at locations/global regardless of this flag. The value is only used in the printed next-step command (--inference-region=%s), making the flag misleading. Similarly, runInferenceStatus (line 245) hardcodes locations/global in the WIF provider path but displays the user-provided --region in output. If the intent is to capture the inference region for handoff to fullsend github setup, the flag help text should say "GCP region for inference (passed to --inference-region in setup)" rather than "WIF location."
  Remediation: Either (a) rename/redocument the flag as a pass-through for --inference-region and not a WIF location control, or (b) remove it from provision-wif since WIF is always global, and keep it only on status for config display.

Low

• [correctness] internal/cli/inference.go:275 — Org condition validation uses strings.Contains(condition, org) which can produce false-positive matches when the org name is a substring of another identifier in the condition (e.g., org "ac" matching a condition containing "acme"). Consider using an exact match against the expected condition string, consistent with the repo-scoped check on line 270.
  Remediation: Replace strings.Contains(condition, org) with an exact match: condition == fmt.Sprintf("assertion.repository_owner == '%s'", strings.ToLower(org)).

• [documentation-currency] docs/guides/dev/cli-internals.md:5 — The CLI Command Tree section does not include the new inference command group (provision-wif, status). The tree should be updated to reflect the new sub-commands.

• [documentation-currency] docs/guides/admin/installation.md:333 — The "Advanced: pre-configure WIF" section documents manual gcloud commands for WIF setup but does not mention fullsend inference provision-wif as a supported alternative. Users may not discover the new command.

[fullsend-ai-review]

[info] style

formatStatusJSON mixes domain keys (FULLSEND_GCP_PROJECT_ID, FULLSEND_GCP_WIF_PROVIDER) with metadata keys (status, details) in a map[string]interface{}. A dedicated struct would make the JSON contract more explicit.

[fullsend-ai-review]

[info] style

formatStatusJSON mixes domain keys (FULLSEND_GCP_PROJECT_ID, FULLSEND_GCP_WIF_PROVIDER) with metadata keys (status, details) in a map[string]interface{}. A dedicated struct would make the JSON contract more explicit.