From f9b3c71e42d113d1327c9d8ced35fe42436edd5f Mon Sep 17 00:00:00 2001
From: Cristian Magherusan-Stanciu <cristi.magherusan@gmail.com>
Date: Tue, 6 Oct 2026 21:56:51 +0200
Subject: [PATCH 1/2] fix(ci): read GCP_PROJECT_ID from vars in rollback.yml

deploy-gcp.yml and cleanup-staging.yml read it from repository variables.
rollback.yml read secrets.GCP_PROJECT_ID, so on a repo configured per the
other workflows the validate job refused to run and a GCP rollback was
blocked during an incident.
---
 .github/workflows/rollback.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/rollback.yml b/.github/workflows/rollback.yml
index 6aa8cb31c..e754e7e8a 100644
--- a/.github/workflows/rollback.yml
+++ b/.github/workflows/rollback.yml
@@ -6,6 +6,9 @@
 # Required GitHub Secrets:
 #   - Same as deployment workflows (AWS, GCP, Azure credentials)
 #
+# Required GitHub Variables:
+#   - GCP_PROJECT_ID (GCP rollback; same variable deploy-gcp.yml reads)
+#
 # Triggered by:
 #   - Manual workflow dispatch only (safety measure)
 
@@ -103,7 +106,7 @@ jobs:
           AWS_ACCOUNT_ID: ${{ vars.AWS_ACCOUNT_ID }}
           AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}
           GCP_REGION: ${{ vars.GCP_REGION || 'us-central1' }}
-          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
+          GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
           ARTIFACT_REGISTRY_REPO: ${{ vars.ARTIFACT_REGISTRY_REPO || 'cudly' }}
           ACR_NAME: ${{ vars.ACR_NAME || 'cudlyacr' }}
         run: |
@@ -141,7 +144,7 @@ jobs:
               ;;
             gcp)
               if [ -z "$GCP_PROJECT_ID" ]; then
-                echo "::error::GCP_PROJECT_ID secret is not set; refusing to guess the project"
+                echo "::error::GCP_PROJECT_ID variable is not set; refusing to guess the project"
                 exit 1
               fi
               IMAGE_URI="${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT_ID}/${ARTIFACT_REGISTRY_REPO}/cudly:${IMAGE_TAG}"
@@ -447,7 +450,7 @@ jobs:
           TF_BACKEND: ${{ secrets.TF_BACKEND_GCP }}
           ENVIRONMENT: ${{ inputs.environment }}
           IMAGE_URI: ${{ needs.validate.outputs.image_uri }}
-          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
+          GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
         run: |
           set -euo pipefail
           printf '%s\nprefix = "github-%s"\n' "$TF_BACKEND" "$ENVIRONMENT" > /tmp/backend.tfbackend

From c8b96bfe70271393a4e5f2ad1f0ba7dc3954d3f1 Mon Sep 17 00:00:00 2001
From: Cristian Magherusan-Stanciu <cristi.magherusan@gmail.com>
Date: Tue, 6 Oct 2026 22:05:34 +0200
Subject: [PATCH 2/2] docs(ci): document GCP_PROJECT_ID as a repository
 variable

The workflows README listed it under secrets and told operators to run
gh secret set, but every GCP workflow reads vars.GCP_PROJECT_ID.
---
 .github/workflows/README.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index e683a92a6..176cb9451 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -170,10 +170,10 @@ Deploy CUDly to GCP Cloud Run. Serverless container platform.
 ### Required Secrets
 
 - `GCP_SA_KEY` (Service Account JSON with permissions)
-- `GCP_PROJECT_ID`
 
 ### Required Variables
 
+- `GCP_PROJECT_ID`
 - `GCP_REGION` (default: us-central1)
 - `ARTIFACT_REGISTRY_REPO` (default: cudly)
 
@@ -464,8 +464,10 @@ gcloud iam service-accounts keys create key.json \
 
 # Set secrets
 gh secret set GCP_SA_KEY < key.json
-gh secret set GCP_PROJECT_ID -b"<project-id>"
 gh secret set DB_PASSWORD_GCP
+
+# Set variables
+gh variable set GCP_PROJECT_ID --body "<project-id>"
 ```
 
 **Azure:**