Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add guide for using workload identity federation #349

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

IchordeDionysos
Copy link

@IchordeDionysos IchordeDionysos commented Mar 14, 2024

Adds the current workaround for using workload identity federation so people more easily are able to find it and use security best practices.

Partially addresses #174

- uses: actions/checkout@v2

# Add these two steps to generate the credential to use with the `action-hosting-deploy` action.
- name: Prepare Google Cloud authentication

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This step seems to be missing id: auth otherwise I think ${{ steps.auth.outputs.credentials_file_path }} won't work below.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- name: Prepare Google Cloud authentication
- name: Prepare Google Cloud authentication
id: auth

create_credentials_file: true
- name: Get federated identity credentials file
run: |
echo "SERVICE_ACCOUNT_KEY=$(cat "${{ steps.auth.outputs.credentials_file_path }}" | tr -d '\n')" >> $GITHUB_ENV

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI this will silently fail if ${{ steps.auth.outputs.credentials_file_path }} resolves to something invalid oder to ''.

uses: 'google-github-actions/auth@v2'
with:
service_account: '[email protected]'
workload_identity_provider: 'projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github/providers/github-your-org'
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
workload_identity_provider: 'projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github/providers/github-your-org'
workload_identity_provider: 'projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github/providers/github-your-org'
token_format: 'access_token'
access_token_scopes: 'email,openid,https://www.googleapis.com/auth/cloudplatformprojects.readonly,https://www.googleapis.com/auth/firebase,https://www.googleapis.com/auth/cloud-platform'

This is what we are using 🤔

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if all of the scopes are strictly necessary

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants