fix(ci): nightly 10 TPS bench GCP auth and checkout (#23586)

## Summary

- Run `gcp_auth` before `setup_gcp_secrets` in `source_network_env` so
EC2 benchmark jobs can read Secret Manager (e.g. `otel-collector-url`).
- Improve `setup_gcp_secrets.sh` diagnostics and activate the CI service
account before secret fetches.
- Install Terraform on Linux in `install_deps.sh`; add `setup-terraform`
on nightly wait jobs.
- Fix `deploy-network` checkout for pinned submodules (`fetch-depth: 0`,
`lfs: true`).
- Checkout `github.sha` on the benchmark job so workflow_dispatch from a
feature branch runs that branch on EC2 (not `next`).

Validated manually via Nightly Bench 10 TPS workflow_dispatch on this
branch (run succeeded).

## Test plan

- [x] Nightly Bench 10 TPS workflow_dispatch from
`spy/10tps-bench-terraform` (deploy, wait, benchmark)

Author: spypsy

.github/workflows/deploy-network.yml

@@ -111,7 +111,9 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           ref: ${{ steps.checkout-ref.outputs.ref }}
-          fetch-depth: 1
+          # Full history so recursive submodules can checkout pinned commits (not only branch tips).
+          fetch-depth: 0
+          lfs: true
           persist-credentials: false
           submodules: recursive # Initialize git submodules for l1-contracts dependencies
 

.github/workflows/nightly-bench-10tps.yml

@@ -80,7 +80,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
-          ref: next
+          ref: ${{ github.sha }}
 
       - name: Authenticate to Google Cloud
         uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f
@@ -108,7 +108,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
-          ref: next
+          ref: ${{ github.sha }}
 
       - name: Run 10 TPS benchmark
         timeout-minutes: 240

.github/workflows/weekly-proving-bench.yml

@@ -71,7 +71,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
-          ref: next
+          ref: ${{ github.sha }}
 
       - name: Authenticate to Google Cloud
         uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f

spartan/scripts/install_deps.sh

@@ -134,6 +134,19 @@ if ! command -v cast &> /dev/null; then
   sudo chmod +x /usr/local/bin/cast
 fi
 
+TERRAFORM_VERSION="1.7.5"
+if ! command -v terraform &> /dev/null; then
+  log "Installing terraform ${TERRAFORM_VERSION}..."
+  tf_os="$(os)"
+  if [ "$tf_os" = "macos" ]; then
+    tf_os="darwin"
+  fi
+  curl -fsSL "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_${tf_os}_$(arch).zip" -o terraform.zip
+  unzip -qo terraform.zip
+  sudo mv terraform /usr/local/bin/terraform
+  rm terraform.zip
+fi
+
 require_cmd git
 require_cmd kubectl
 require_cmd terraform

spartan/scripts/source_network_env.sh

@@ -24,6 +24,15 @@ function source_network_env {
       if grep -q "REPLACE_WITH_GCP_SECRET" "$env_file" && command -v gcloud &> /dev/null; then
         echo "Environment file contains GCP secret placeholders. Processing secrets..."
 
+        # Activate GCP credentials before Secret Manager reads (same order as network_deploy.sh).
+        if declare -f gcp_auth >/dev/null 2>&1; then
+          gcp_auth
+        else
+          # shellcheck source=scripts/gcp_auth.sh
+          source "$spartan/scripts/gcp_auth.sh"
+          gcp_auth
+        fi
+
         # Process GCP secrets
         source $spartan/scripts/setup_gcp_secrets.sh "$env_file"