merge: integrate phase 05.1 github-actions-ci-cd into main

Phase 05.1 delivers the GitHub Actions CD pipeline rewrite:
- IMAGE_TAG Pulumi config key with ENV fallback
- Two-job cd-base.yml (build + deploy) with WIF auth, Docker GHA layer cache, SHA-only image tags, imageTag config-map passthrough, and dev health check
- cd-dev.yml triggers on push to main
- cd-staging.yml is workflow_dispatch only (no PR trigger)
- cd-prod.yml uses environment: prod approval gate
- Static test scaffold (23 tests) validates all CD contracts via YAML and AST parsing

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ahcarpenter

.github/workflows/cd-base.yml

@@ -1,6 +1,6 @@
 name: CD Base
 
-on:
+"on":
   workflow_call:
     inputs:
       stack:
@@ -12,42 +12,68 @@ on:
       environment:
         required: false
         type: string
+      gcp_project:
+        required: true
+        type: string
     secrets:
       WIF_PROVIDER:
         required: true
       WIF_SERVICE_ACCOUNT:
         required: true
       PULUMI_CONFIG_PASSPHRASE:
         required: true
+    outputs:
+      sha:
+        description: "7-char git SHA used as image tag"
+        value: ${{ jobs.build.outputs.sha }}
 
 jobs:
-  deploy:
+  build:
     runs-on: ubuntu-latest
-    environment: ${{ inputs.environment }}
     permissions:
       contents: read
       id-token: write
-
+    outputs:
+      sha: ${{ steps.sha.outputs.sha }}
     steps:
       - uses: actions/checkout@v4
 
+      - id: sha
+        run: echo "sha=$(git rev-parse --short=7 HEAD)" >> "$GITHUB_OUTPUT"
+
       - uses: google-github-actions/auth@v3
         with:
           workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
           service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }}
 
+      - uses: docker/setup-buildx-action@v3
+
       - name: Configure Docker for Artifact Registry
         run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
 
-      - name: Build and push image
+      - uses: docker/build-push-action@v6
         if: inputs.command == 'up'
-        run: |
-          PROJECT_ID=$(gcloud config get-value project)
-          IMAGE="us-central1-docker.pkg.dev/${PROJECT_ID}/vici-images/vici"
-          SHA=$(git rev-parse --short HEAD)
-          docker build -t "${IMAGE}:${SHA}" -t "${IMAGE}:${{ inputs.stack }}" .
-          docker push "${IMAGE}:${SHA}"
-          docker push "${IMAGE}:${{ inputs.stack }}"
+        with:
+          context: .
+          push: true
+          tags: us-central1-docker.pkg.dev/${{ inputs.gcp_project }}/vici-images/vici:${{ steps.sha.outputs.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: [build]
+    environment: ${{ inputs.environment }}
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: google-github-actions/auth@v3
+        with:
+          workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
+          service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }}
 
       - uses: astral-sh/setup-uv@v5
         with:
@@ -61,6 +87,22 @@ jobs:
           command: ${{ inputs.command }}
           stack-name: ${{ inputs.stack }}
           work-dir: infra
+          cloud-url: gs://vici-app-pulumi-state-${{ inputs.stack }}
+          config-map: '{"vici-infra:imageTag": {"value": "${{ needs.build.outputs.sha }}", "secret": false}}'
         env:
           PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }}
-          PULUMI_BACKEND_URL: gs://vici-app-pulumi-state-${{ inputs.stack }}
+
+      - name: Health check
+        if: inputs.stack == 'dev' && inputs.command == 'up'
+        run: |
+          for i in $(seq 1 12); do
+            STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://dev.usevici.com/health)
+            if [ "$STATUS" = "200" ]; then
+              echo "Health check passed (attempt $i)"
+              exit 0
+            fi
+            echo "Attempt $i: got $STATUS, retrying in 5s..."
+            sleep 5
+          done
+          echo "Health check failed after 60s"
+          exit 1

.github/workflows/cd-dev.yml

@@ -1,6 +1,6 @@
 name: CD Dev
 
-on:
+"on":
   push:
     branches: [main]
 
@@ -14,7 +14,8 @@ jobs:
     with:
       stack: dev
       command: up
+      gcp_project: vici-app-dev
     secrets:
-      WIF_PROVIDER: ${{ secrets.GCP_WIF_PROVIDER_DEV }}
-      WIF_SERVICE_ACCOUNT: ${{ secrets.GCP_CI_SA_DEV }}
+      WIF_PROVIDER: ${{ secrets.GCP_WIF_PROVIDER }}
+      WIF_SERVICE_ACCOUNT: ${{ secrets.GCP_CI_SA_EMAIL }}
       PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }}

.github/workflows/cd-prod.yml

@@ -1,6 +1,6 @@
 name: CD Prod
 
-on:
+"on":
   workflow_dispatch:
 
 permissions:
@@ -14,7 +14,8 @@ jobs:
       stack: prod
       command: up
       environment: prod
+      gcp_project: vici-app-prod
     secrets:
-      WIF_PROVIDER: ${{ secrets.GCP_WIF_PROVIDER_PROD }}
-      WIF_SERVICE_ACCOUNT: ${{ secrets.GCP_CI_SA_PROD }}
+      WIF_PROVIDER: ${{ secrets.GCP_WIF_PROVIDER }}
+      WIF_SERVICE_ACCOUNT: ${{ secrets.GCP_CI_SA_EMAIL }}
       PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }}

.github/workflows/cd-staging.yml

@@ -1,33 +1,20 @@
 name: CD Staging
 
-on:
-  pull_request:
-    branches: [main]
+"on":
   workflow_dispatch:
 
 permissions:
   contents: read
   id-token: write
 
 jobs:
-  preview:
-    if: github.event_name == 'pull_request'
-    uses: ./.github/workflows/cd-base.yml
-    with:
-      stack: staging
-      command: preview
-    secrets:
-      WIF_PROVIDER: ${{ secrets.GCP_WIF_PROVIDER_STAGING }}
-      WIF_SERVICE_ACCOUNT: ${{ secrets.GCP_CI_SA_STAGING }}
-      PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }}
-
-  deploy:
-    if: github.event_name == 'workflow_dispatch'
+  deploy-staging:
     uses: ./.github/workflows/cd-base.yml
     with:
       stack: staging
       command: up
+      gcp_project: vici-app-staging
     secrets:
-      WIF_PROVIDER: ${{ secrets.GCP_WIF_PROVIDER_STAGING }}
-      WIF_SERVICE_ACCOUNT: ${{ secrets.GCP_CI_SA_STAGING }}
+      WIF_PROVIDER: ${{ secrets.GCP_WIF_PROVIDER }}
+      WIF_SERVICE_ACCOUNT: ${{ secrets.GCP_CI_SA_EMAIL }}
       PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }}

.planning/workstreams/gks-refactor/ROADMAP.md

@@ -115,8 +115,8 @@ Plans:
 **Plans**: 2 plans
 
 Plans:
-- [ ] 05.1-01-PLAN.md — Test scaffold and IMAGE_TAG config key for Pulumi
-- [ ] 05.1-02-PLAN.md — Rewrite all four CD workflow files to match locked decisions
+- [x] 05.1-01-PLAN.md — Test scaffold and IMAGE_TAG config key for Pulumi
+- [x] 05.1-02-PLAN.md — Rewrite all four CD workflow files to match locked decisions
 
 ### Phase 6: Infra Best-Practice Audit and Edge-Case Hardening
 **Goal**: All stateful infrastructure is protected from accidental deletion, namespaces enforce least-privilege network access, Temporal credentials follow the ESO pattern, and operators have a runbook for edge-case scenarios

.planning/workstreams/gks-refactor/STATE.md

@@ -4,8 +4,8 @@ milestone: v1.0
 milestone_name: milestone
 status: executing
 stopped_at: Phase 5.1 context gathered
-last_updated: "2026-04-10T03:27:00.619Z"
-last_activity: 2026-04-10 -- Phase 5.1 planning complete
+last_updated: "2026-04-11T19:21:43.667Z"
+last_activity: 2026-04-11 -- Phase 05.1 execution started
 progress:
   total_phases: 7
   completed_phases: 4
@@ -21,15 +21,15 @@ progress:
 See: .planning/workstreams/gks-refactor/PROJECT.md (updated 2026-04-04)
 
 **Core value:** All three environments run on 1:1 mirrored GKE infrastructure managed by a single Pulumi program
-**Current focus:** Phase 05 — application-deployment-and-ci-cd
+**Current focus:** Phase 05.1 — github-actions-ci-cd
 
 ## Current Position
 
-Phase: 05
-Plan: Not started
+Phase: 05.1 (github-actions-ci-cd) — EXECUTING
+Plan: 1 of 2
 Plans: 3/3 complete, human UAT approved
-Status: Ready to execute
-Last activity: 2026-04-10 -- Phase 5.1 planning complete
+Status: Executing Phase 05.1
+Last activity: 2026-04-11 -- Phase 05.1 execution started
 
 Progress: [████████░░] 83% (5 of 6 phases complete)
 

.planning/workstreams/gks-refactor/phases/05.1-github-actions-ci-cd/05.1-01-SUMMARY.md

@@ -0,0 +1,100 @@
+---
+phase: 05.1-github-actions-ci-cd
+plan: "01"
+subsystem: infra
+tags: [cd, image-tag, pulumi-config, test-scaffold, static-analysis]
+dependency_graph:
+  requires: []
+  provides: [IMAGE_TAG config key, CD static test scaffold]
+  affects: [infra/config.py, infra/components/app.py, tests/infra/]
+tech_stack:
+  added: []
+  patterns: [AST-based static test, YAML-based workflow test, Pulumi config fallback]
+key_files:
+  created:
+    - tests/infra/test_cd_workflows_static.py
+    - tests/infra/test_cd_static.py
+  modified:
+    - infra/config.py
+    - infra/components/app.py
+decisions:
+  - IMAGE_TAG uses cfg.get() (optional) not cfg.require() so local dev works without the flag
+  - ENV fallback preserves existing behavior for manual pulumi up without --config imageTag
+  - Test scaffold created before workflow files (Wave 0 pattern) so Plan 02 has concrete assertions to satisfy
+metrics:
+  duration: "~5 minutes"
+  completed_date: "2026-04-11"
+  tasks_completed: 2
+  files_modified: 4
+---
+
+# Phase 05.1 Plan 01: IMAGE_TAG Config and CD Test Scaffold Summary
+
+**One-liner:** IMAGE_TAG config key with ENV fallback added to Pulumi; static test scaffold validates all CD-01 through CD-05 contracts via YAML and AST parsing.
+
+## Tasks Completed
+
+| Task | Name | Commit | Files |
+|------|------|--------|-------|
+| 1 | Create static test scaffold for CD workflows and imageTag config | 50914d5 | tests/infra/test_cd_workflows_static.py, tests/infra/test_cd_static.py |
+| 2 | Add IMAGE_TAG config key to config.py and update app.py | 450e6cf | infra/config.py, infra/components/app.py |
+
+## What Was Built
+
+### IMAGE_TAG Pulumi Config Key (Task 2)
+
+Added `IMAGE_TAG: str = cfg.get("imageTag") or ENV` to `infra/config.py`. When CI runs `pulumi up --config vici-infra:imageTag=a1b2c3d`, the deployed container image tag is the 7-char git SHA (e.g., `us-central1-docker.pkg.dev/PROJECT/vici/app:a1b2c3d`). When running locally without the flag, `IMAGE_TAG` falls back to `ENV` (e.g., "dev"), preserving existing behavior.
+
+Updated `infra/components/app.py` to import `IMAGE_TAG` alongside `ENV` and use it in the `pulumi.Output.concat(registry_url, "/vici:", IMAGE_TAG)` call.
+
+### CD Static Test Scaffold (Task 1)
+
+Two test files establish the RED → GREEN contract for Plan 02:
+
+**`tests/infra/test_cd_workflows_static.py`** — Six test classes using `yaml.safe_load`:
+- `TestCD01DevAutoDeployOnMain` — cd-dev.yml push-to-main trigger and cd-base.yml call with `command: up, stack: dev`
+- `TestCD02StagingManualDispatchOnly` — cd-staging.yml has `workflow_dispatch` only (no `pull_request`)
+- `TestCD03ProdEnvironmentApproval` — cd-prod.yml passes `with.environment: prod`
+- `TestCD04WIFAuth` — cd-base.yml build+deploy jobs use `google-github-actions/auth@v3`, no static keys, `id-token: write`
+- `TestCD05CIUnchanged` — ci.yml has no `google-github-actions` steps and no `gcloud` run commands
+- `TestCDBaseStructure` — cd-base.yml has exactly `{build, deploy}` jobs, deploy needs build, build outputs sha, Docker GHA cache, conditional push on `command == up`, `gcp_project` input required, health check on dev up, pulumi config-map with imageTag
+
+**`tests/infra/test_cd_static.py`** — Two test classes using `ast` module:
+- `TestImageTagConfig` — config.py has module-level `IMAGE_TAG` assignment and `cfg.get("imageTag") or ENV` pattern
+- `TestAppUsesImageTag` — app.py imports `IMAGE_TAG` on the `from config import` line and uses it (not `ENV`) in the registry_url concat
+
+## Test State After This Plan
+
+| Test Class | Status | Reason |
+|------------|--------|--------|
+| TestCD05CIUnchanged | PASS | ci.yml already has no GCP steps |
+| TestCD01DevAutoDeployOnMain::test_cd_dev_calls_cd_base_with_up | PASS | Existing cd-dev.yml happens to call cd-base.yml |
+| TestCD03ProdEnvironmentApproval::test_cd_prod_passes_environment_prod | PASS | Existing cd-prod.yml passes environment |
+| TestCD04WIFAuth::test_cd_base_deploy_job_uses_wif_auth | PASS | Existing cd-base.yml has WIF in single deploy job |
+| TestCD04WIFAuth::test_cd_base_no_static_key_steps | PASS | No static keys in existing workflow |
+| TestImageTagConfig (both) | PASS | Task 2 GREEN |
+| TestAppUsesImageTag (both) | PASS | Task 2 GREEN |
+| All remaining | FAIL | Expected RED — workflow files not yet rewritten (Plan 02) |
+
+## Deviations from Plan
+
+None — plan executed exactly as written.
+
+## Known Stubs
+
+None — IMAGE_TAG is fully wired from config.py to app.py. No placeholder values.
+
+## Threat Flags
+
+None — no new network endpoints, auth paths, or trust boundary crossings introduced. IMAGE_TAG is a non-secret Pulumi config value (git SHA string); T-5.1-01 disposition is `accept` per plan threat model.
+
+## Self-Check: PASSED
+
+- `tests/infra/test_cd_workflows_static.py` exists and contains all 6 required test classes
+- `tests/infra/test_cd_static.py` exists and contains both required test classes
+- Commit 50914d5 exists (test scaffold)
+- Commit 450e6cf exists (IMAGE_TAG config)
+- `grep "IMAGE_TAG" infra/config.py` returns the assignment line
+- `grep "IMAGE_TAG" infra/components/app.py` returns import and usage lines
+- `uv run pytest tests/infra/test_cd_static.py` — 4 passed
+- `uv run pytest tests/infra/test_cd_workflows_static.py::TestCD05CIUnchanged` — 1 passed