chore(.github): remove fly.io workspace-proxy deployment (#25126)

Removes the fly.io-based workspace-proxy deployment from CI. The dogfood
workspace proxies in Paris (`cdg`), Sydney (`syd`), and Johannesburg
(`jnb`) are no longer deployed via fly.io, and the São Paulo proxy
session-token secret was already unreferenced in `deploy.yaml`.

## Changes

- Deleted `.github/fly-wsproxies/{paris,sydney,jnb}-coder.toml`.
- Removed the `deploy-wsproxies` job from
`.github/workflows/deploy.yaml`,
along with its `workflow_call.secrets` block declaring the five `FLY_*`
  inputs.
- Removed the matching `secrets:` pass-through from the `deploy` job in
  `.github/workflows/ci.yaml`.

The Kubernetes/EKS dogfood deploy job and `should_deploy.sh` logic are
unchanged.

## Repository secrets that can now be deleted

Once this lands, the following GitHub Actions repository secrets are no
longer referenced anywhere in this repo and are safe to remove:

- `FLY_API_TOKEN`
- `FLY_PARIS_CODER_PROXY_SESSION_TOKEN`
- `FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN`
- `FLY_JNB_CODER_PROXY_SESSION_TOKEN`
- `FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN` (was already passed through
  but unused inside `deploy.yaml`)

Worth double-checking they aren't referenced by any other repos / org
workflows before deleting from the org/repo settings.

## Out of scope (intentionally left alone)

- `site/static/icon/fly.io.svg` — region icon, used at runtime for any
  user-deployed workspace proxy that picks the fly.io icon.
- `docs/install/other/index.md` — unofficial "Run Coder on Fly.io"
  community install entry, unrelated to our CI.
- `site/src/testHelpers/entities.ts` `*.fly.dev.coder.com` strings — UI
  test fixtures.

## Validation

- `python3 -c "yaml.safe_load(...)"` on both edited workflows.
- `make pre-commit` ran via the git hook on commit (actionlint,
shellcheck,
  typos, helm, markdown, etc. all green).
- Repo-wide grep confirms no remaining `FLY_`, `flyctl`, `fly.toml`, or
  `fly-wsproxies` references in `.github/` or `scripts/`.

.github/fly-wsproxies/jnb-coder.toml

@@ -1,34 +0,0 @@
-app = "jnb-coder"
-primary_region = "jnb"
-
-[experimental]
-  entrypoint = ["/bin/sh", "-c", "CODER_DERP_SERVER_RELAY_URL=\"http://[${FLY_PRIVATE_IP}]:3000\" /opt/coder wsproxy server"]
-  auto_rollback = true
-
-[build]
-  image = "ghcr.io/coder/coder-preview:main"
-
-[env]
-  CODER_ACCESS_URL = "https://jnb.fly.dev.coder.com"
-  CODER_HTTP_ADDRESS = "0.0.0.0:3000"
-  CODER_PRIMARY_ACCESS_URL = "https://dev.coder.com"
-  CODER_WILDCARD_ACCESS_URL = "*--apps.jnb.fly.dev.coder.com"
-  CODER_VERBOSE = "true"
-
-[http_service]
-  internal_port = 3000
-  force_https = true
-  auto_stop_machines = true
-  auto_start_machines = true
-  min_machines_running = 0
-
-# Ref: https://fly.io/docs/reference/configuration/#http_service-concurrency
-[http_service.concurrency]
-  type = "requests"
-  soft_limit = 50
-  hard_limit = 100
-
-[[vm]]
-  cpu_kind = "shared"
-  cpus = 2
-  memory_mb = 512

.github/fly-wsproxies/paris-coder.toml

@@ -1,34 +0,0 @@
-app = "paris-coder"
-primary_region = "cdg"
-
-[experimental]
-  entrypoint = ["/bin/sh", "-c", "CODER_DERP_SERVER_RELAY_URL=\"http://[${FLY_PRIVATE_IP}]:3000\" /opt/coder wsproxy server"]
-  auto_rollback = true
-
-[build]
-  image = "ghcr.io/coder/coder-preview:main"
-
-[env]
-  CODER_ACCESS_URL = "https://paris.fly.dev.coder.com"
-  CODER_HTTP_ADDRESS = "0.0.0.0:3000"
-  CODER_PRIMARY_ACCESS_URL = "https://dev.coder.com"
-  CODER_WILDCARD_ACCESS_URL = "*--apps.paris.fly.dev.coder.com"
-  CODER_VERBOSE = "true"
-
-[http_service]
-  internal_port = 3000
-  force_https = true
-  auto_stop_machines = true
-  auto_start_machines = true
-  min_machines_running = 0
-
-# Ref: https://fly.io/docs/reference/configuration/#http_service-concurrency
-[http_service.concurrency]
-  type = "requests"
-  soft_limit = 50
-  hard_limit = 100
-
-[[vm]]
-  cpu_kind = "shared"
-  cpus = 2
-  memory_mb = 512

.github/fly-wsproxies/sydney-coder.toml

@@ -1,34 +0,0 @@
-app = "sydney-coder"
-primary_region = "syd"
-
-[experimental]
-  entrypoint = ["/bin/sh", "-c", "CODER_DERP_SERVER_RELAY_URL=\"http://[${FLY_PRIVATE_IP}]:3000\" /opt/coder wsproxy server"]
-  auto_rollback = true
-
-[build]
-  image = "ghcr.io/coder/coder-preview:main"
-
-[env]
-  CODER_ACCESS_URL = "https://sydney.fly.dev.coder.com"
-  CODER_HTTP_ADDRESS = "0.0.0.0:3000"
-  CODER_PRIMARY_ACCESS_URL = "https://dev.coder.com"
-  CODER_WILDCARD_ACCESS_URL = "*--apps.sydney.fly.dev.coder.com"
-  CODER_VERBOSE = "true"
-
-[http_service]
-  internal_port = 3000
-  force_https = true
-  auto_stop_machines = true
-  auto_start_machines = true
-  min_machines_running = 0
-
-# Ref: https://fly.io/docs/reference/configuration/#http_service-concurrency
-[http_service.concurrency]
-  type = "requests"
-  soft_limit = 50
-  hard_limit = 100
-
-[[vm]]
-  cpu_kind = "shared"
-  cpus = 2
-  memory_mb = 512

.github/workflows/ci.yaml

@@ -1555,12 +1555,6 @@ jobs:
       contents: read
       id-token: write
       packages: write # to retag image as dogfood
-    secrets:
-      FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
-      FLY_PARIS_CODER_PROXY_SESSION_TOKEN: ${{ secrets.FLY_PARIS_CODER_PROXY_SESSION_TOKEN }}
-      FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN: ${{ secrets.FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN }}
-      FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN: ${{ secrets.FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN }}
-      FLY_JNB_CODER_PROXY_SESSION_TOKEN: ${{ secrets.FLY_JNB_CODER_PROXY_SESSION_TOKEN }}
 
   # sqlc-vet runs a postgres docker container, runs Coder migrations, and then
   # runs sqlc-vet to ensure all queries are valid. This catches any mistakes

.github/workflows/deploy.yaml

@@ -8,17 +8,6 @@ on:
         description: "Image and tag to potentially deploy. Current branch will be validated against should-deploy check."
         required: true
         type: string
-    secrets:
-      FLY_API_TOKEN:
-        required: true
-      FLY_PARIS_CODER_PROXY_SESSION_TOKEN:
-        required: true
-      FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN:
-        required: true
-      FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN:
-        required: true
-      FLY_JNB_CODER_PROXY_SESSION_TOKEN:
-        required: true
 
 permissions:
   contents: read
@@ -136,33 +125,3 @@ jobs:
           kubectl --namespace coder rollout status deployment/coder-provisioner-tagged
           kubectl --namespace coder rollout restart deployment/coder-provisioner-tagged-prebuilds
           kubectl --namespace coder rollout status deployment/coder-provisioner-tagged-prebuilds
-
-  deploy-wsproxies:
-    runs-on: ubuntu-latest
-    needs: deploy
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup flyctl
-        uses: superfly/flyctl-actions/setup-flyctl@ed8efb33836e8b2096c7fd3ba1c8afe303ebbff1 # v1.6
-
-      - name: Deploy workspace proxies
-        run: |
-          flyctl deploy --image "$IMAGE" --app paris-coder --config ./.github/fly-wsproxies/paris-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_PARIS" --yes
-          flyctl deploy --image "$IMAGE" --app sydney-coder --config ./.github/fly-wsproxies/sydney-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_SYDNEY" --yes
-          flyctl deploy --image "$IMAGE" --app jnb-coder --config ./.github/fly-wsproxies/jnb-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_JNB" --yes
-        env:
-          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
-          IMAGE: ${{ inputs.image }}
-          TOKEN_PARIS: ${{ secrets.FLY_PARIS_CODER_PROXY_SESSION_TOKEN }}
-          TOKEN_SYDNEY: ${{ secrets.FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN }}
-          TOKEN_JNB: ${{ secrets.FLY_JNB_CODER_PROXY_SESSION_TOKEN }}