[0rierel]

Why

GitHub Actions artifact storage counts against the org's GitHub quota and billing limits. The springdotnew org is moving artifact and package storage to GCP project spring-452820. This PR moves echoform's only artifact upload, the Playwright results on failure, to gs://spring-452820-gha-artifacts.

What changed

.github/workflows/ci.yml, job build-and-test (GitHub-hosted ubuntu-latest):

• Permissions: added a job permissions block with contents: read (all actions/checkout needs) and id-token: write. The workflow had no permissions block before, so the job now gets only these two scopes. None of its steps use anything else.
• Auth step: new step google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 with if: failure(). It uses direct Workload Identity Federation through projects/59831676433/locations/global/workloadIdentityPools/github/providers/springdotnew, with no service account. The bucket grants objectAdmin on artifacts/echoform/ to principalSet …/attribute.repository/springdotnew/echoform.
• Upload step: actions/upload-artifact@v4 (playwright-results, 7-day retention) is replaced by a gcloud storage cp -r step, still under if: failure().
  • Where files go: each existing demo/<app>/test-results and demo/<app>/playwright-report goes to gs://spring-452820-gha-artifacts/artifacts/echoform/<run_id>/playwright-results/<app>/.
  • Expiry: objects get --custom-time = now + 7 days. The bucket deletes them one day after customTime.
  • Why one cp per demo: a single cp -r demo/*/test-results/ … would copy every app's folder to the same test-results/ prefix, and the apps would overwrite each other. Copying per demo keeps each app's results separate, the same layout the old artifact had.
  • No files: if neither folder exists, the step logs a warning and succeeds. That matches upload-artifact's default if-no-files-found: warn.
  • Summary link: the step writes the console link https://console.cloud.google.com/storage/browser/spring-452820-gha-artifacts/artifacts/echoform/<run_id>/playwright-results to the job summary.
• gcloud: no setup-gcloud step. The Google Cloud CLI is preinstalled on ubuntu-latest.

Nothing reads these artifacts. No other workflow uploads or downloads artifacts (release.yml and deploy-wmux-client.yml have none).

How it was verified (locally; echoform's hosted CI runs rarely)

• Install: bun install --frozen-lockfile passed. No git hooks are configured in this repo.
• Lint: bun run lint passed (0 errors; the 8 warnings are already on master).
• Typecheck: bun run typecheck passed.
• Build: bun run build and the packages/wmux-client build both passed.
• Unit tests: packages/echoform bun run test passed, 8/8.
• Playwright:
  • todo-app: 6/6 passed.
  • file-editor: 5/5 passed.
  • dev-server: 2/4 passed. The cold first-page tests (should render xterm terminal, late-joining client receives terminal history) hit their 15s waitForSelector timeout in a heavily loaded shared dev pod. This PR changes only .github/workflows/ci.yml, so the demo code is identical to master, and master's hosted CI is green (run 35001053255). This PR's own CI run is the authoritative check.
• actionlint: 1.7.12, with shellcheck, is clean on every workflow.
• Upload script: ran the step's script under bash -e with a stub gcloud:
  • With results present, it makes one cp per demo directory to the expected per-app prefix and writes the summary link.
  • With no results, it warns and exits 0.
  • If gcloud fails, the step fails.
• gcloud behaviour: confirmed from the Cloud SDK source (copy_task_iterator.py) that a destination ending in / keeps the source folder name.

The upload path runs only when an earlier step fails, so a green CI run does not exercise it.

Dependencies

• Needs the bucket, the WIF provider springdotnew, and objectAdmin on artifacts/echoform/ for principalSet …/attribute.repository/springdotnew/echoform. The coordinator applied all three in O1 on 2026-10-11.
• Nothing else has to be merged first.

Part of the springdotnew GCP storage migration (lane A3).