[cristim]

Problem

GCP deploys have been failing since the base branch changed from
feat/multicloud-web-frontend to main (around 2026-06-09) with:

google-github-actions/auth failed: ... {"error":"unauthorized_client","error_description":"The given credential is rejected by the attribute condition."}

The WIF provider's attribute_condition gates on both repository and ref:

assertion.repository == 'LeanerCloud/CUDly' && assertion.ref == '<deploy_ref>'

The live condition (verified read-only via gcloud) still says:

assertion.ref == 'refs/heads/feat/multicloud-web-frontend'

This rejects every push to main. The local terraform.tfvars (gitignored)
was last applied with deploy_ref = "refs/heads/feat/multicloud-web-frontend".

Root cause

The terraform.tfvars override was not updated after the branch merge.
variables.tf already defaults deploy_ref to refs/heads/main, so a fresh
apply with no override (or with deploy_ref = "refs/heads/main") fixes it.

What this PR changes

• README: replaces the incorrect attribute_condition description (it was
  documented as repo-only) with the accurate two-clause form, adds the
  operator gcloud command to inspect the live condition, and explains the
  flip-back requirement.
• terraform.tfvars.example: adds an IMPORTANT warning about updating
  deploy_ref when the base branch changes, with the exact lockout error to
  watch for.
• github_oidc.tf: inline comment explaining the lockout risk and the
  flip-back rule.

No Terraform logic changed; terraform fmt -check, terraform init -backend=false,
and terraform validate all exit 0.

Operator apply step

See the runbook comment on #1372 for exact commands. Short version:

cd terraform/environments/gcp/ci-cd-permissions
# edit terraform.tfvars: deploy_ref = "refs/heads/main"
terraform init -backend-config=backend.hcl
terraform apply

Then re-run "Deploy to GCP Cloud Run" from the Actions tab to verify.

Drift note

Live GCP condition exactly matches what Terraform would produce from the
stale terraform.tfvars (no unexpected drift). After applying with
deploy_ref = "refs/heads/main", the condition becomes:

assertion.repository == 'LeanerCloud/CUDly' && assertion.ref == 'refs/heads/main'

Ref: #1372 (GCP half; AWS half tracked in #1375 - do not close #1372 via this PR)

[cristim]

@coderabbitai review

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 58 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f2017002-92e3-4b5a-a631-349b9a0237b5

📥 Commits

Reviewing files that changed from the base of the PR and between ca17257 and ebb49cc.

📒 Files selected for processing (3)

• terraform/environments/gcp/ci-cd-permissions/README.md
• terraform/environments/gcp/ci-cd-permissions/github_oidc.tf
• terraform/environments/gcp/ci-cd-permissions/terraform.tfvars.example

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/gcp-wif-attribute-condition

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cristim]

Merged to main: documents the WIF deploy_ref pinning trap that caused the GCP deploy outage (stale local tfvars pinned the retired feature branch; fix applied and confirmed end-to-end on run 29514101154). README now documents the actual attribute condition (repository AND ref), the gcloud inspect command, and the flip-back requirement.