fix: prefer control-plane runtime target variable

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

.github/workflows/ci.yml

@@ -19,8 +19,8 @@ jobs:
       - name: Reject public runtime configuration bindings
         run: |
           set -euo pipefail
-          if rg -n '\$\{\{[[:space:]]*vars\.(CLOUD_RUN_SERVICE_TARGETS_JSON|RUNTIME_TARGET_JSON|GLOBAL_TELEGRAM_CHAT_ID|CLOUD_RUN_SERVICES|CLOUD_RUN_SERVICE|RUNTIME_HEARTBEAT_REQUIRED_SERVICES|RUNTIME_GUARD_SCHEDULER_JOB_PATTERN)' .github/workflows; then
-            echo "Operational runtime configuration must use GitHub Secrets, not GitHub Variables." >&2
+          if rg -n '\$\{\{[[:space:]]*vars\.(CLOUD_RUN_SERVICE_TARGETS_JSON|GLOBAL_TELEGRAM_CHAT_ID|CLOUD_RUN_SERVICES|CLOUD_RUN_SERVICE|RUNTIME_HEARTBEAT_REQUIRED_SERVICES|RUNTIME_GUARD_SCHEDULER_JOB_PATTERN)' .github/workflows; then
+            echo "Sensitive operational runtime configuration must use GitHub Secrets, not GitHub Variables." >&2
             exit 1
           fi
 

.github/workflows/execution-report-heartbeat.yml

@@ -50,7 +50,7 @@ jobs:
       RUNTIME_HEARTBEAT_SCHEDULER_AWARE: ${{ vars.RUNTIME_HEARTBEAT_SCHEDULER_AWARE || 'true' }}
       RUNTIME_HEARTBEAT_SCHEDULER_LOCATION: ${{ vars.RUNTIME_HEARTBEAT_SCHEDULER_LOCATION || vars.CLOUD_RUN_REGION || 'us-central1' }}
       RUNTIME_TARGET_ENABLED: ${{ vars.RUNTIME_TARGET_ENABLED }}
-      RUNTIME_TARGET_JSON: ${{ secrets.RUNTIME_TARGET_JSON }}
+      RUNTIME_TARGET_JSON: ${{ vars.RUNTIME_TARGET_JSON || secrets.RUNTIME_TARGET_JSON }}
       CLOUD_RUN_REGION: ${{ vars.CLOUD_RUN_REGION }}
       CLOUD_RUN_SERVICE: ${{ secrets.CLOUD_RUN_SERVICE }}
       CLOUD_RUN_SERVICES: ${{ secrets.CLOUD_RUN_SERVICES }}

.github/workflows/runtime-target-lifecycle.yml

@@ -24,7 +24,7 @@ jobs:
       id-token: write
     env:
       RUNTIME_TARGET_ENABLED: ${{ vars.RUNTIME_TARGET_ENABLED }}
-      RUNTIME_TARGET_JSON: ${{ secrets.RUNTIME_TARGET_JSON }}
+      RUNTIME_TARGET_JSON: ${{ vars.RUNTIME_TARGET_JSON || secrets.RUNTIME_TARGET_JSON }}
       FIRSTRADE_DRY_RUN_ONLY: ${{ vars.FIRSTRADE_DRY_RUN_ONLY }}
       CLOUD_RUN_REGION: ${{ vars.CLOUD_RUN_REGION }}
       CLOUD_RUN_SERVICE: ${{ secrets.CLOUD_RUN_SERVICE }}

.github/workflows/sync-cloud-run-env.yml

@@ -52,7 +52,9 @@ jobs:
       FIRSTRADE_MFA_EMAIL_SECRET_NAME: ${{ vars.FIRSTRADE_MFA_EMAIL_SECRET_NAME }}
       FIRSTRADE_MFA_PHONE_SECRET_NAME: ${{ vars.FIRSTRADE_MFA_PHONE_SECRET_NAME }}
       FIRSTRADE_MFA_CODE_SECRET_NAME: ${{ vars.FIRSTRADE_MFA_CODE_SECRET_NAME }}
-      RUNTIME_TARGET_JSON: ${{ secrets.RUNTIME_TARGET_JSON }}
+      # This is validated deployment intent, not credential material. Prefer the
+      # control-plane variable while retaining a legacy-secret fallback during migration.
+      RUNTIME_TARGET_JSON: ${{ vars.RUNTIME_TARGET_JSON || secrets.RUNTIME_TARGET_JSON }}
       ACCOUNT_PREFIX: ${{ vars.ACCOUNT_PREFIX }}
       ACCOUNT_REGION: ${{ vars.ACCOUNT_REGION }}
       FIRSTRADE_ACCOUNT: ${{ vars.FIRSTRADE_ACCOUNT }}