feat(platform/infra): Create prod service account and pool (#8383)

* ci with workload identity

* temp update

* update name

* wip

* update auth step

* update provider name

* remove audience

* temp set to false

* update registry naming

* update context

* update login

* revert temp updates

* add prod iam and pool

autogpt_platform/infra/terraform/environments/prod.tfvars

@@ -28,6 +28,11 @@ service_accounts = {
    "prod-agpt-market-sa" = {
     display_name = "AutoGPT prod Market backend Account"
     description  = "Service account for agpt prod market backend"
+  },
+  "prod-github-actions-workload-identity" = {
+    service_account_name = "prod-github-actions-sa"
+    namespace            = "prod-agpt"
+    ksa_name             = "prod-github-actions-sa"
   }
 }
 
@@ -59,7 +64,8 @@ role_bindings = {
     "serviceAccount:[email protected]",
     "serviceAccount:[email protected]",
     "serviceAccount:[email protected]",
-    "serviceAccount:[email protected]"
+    "serviceAccount:[email protected]",
+    "serviceAccount:[email protected]"
   ],
   "roles/cloudsql.client" = [
     "serviceAccount:[email protected]",
@@ -80,7 +86,8 @@ role_bindings = {
     "serviceAccount:[email protected]",
     "serviceAccount:[email protected]",
     "serviceAccount:[email protected]",
-    "serviceAccount:[email protected]"
+    "serviceAccount:[email protected]",
+    "serviceAccount:[email protected]"
   ]
   "roles/compute.networkUser" = [
     "serviceAccount:[email protected]",
@@ -93,6 +100,16 @@ role_bindings = {
     "serviceAccount:[email protected]",
     "serviceAccount:[email protected]",
     "serviceAccount:[email protected]"
+  ],
+  "roles/artifactregistry.writer" = [
+    "serviceAccount:[email protected]"
+  ],
+  "roles/container.viewer" = [
+    "serviceAccount:[email protected]"
+  ],
+  "roles/iam.serviceAccountTokenCreator" = [
+    "principalSet://iam.googleapis.com/projects/638488734936/locations/global/workloadIdentityPools/prod-pool/*",
+    "serviceAccount:[email protected]"
   ]
 }
 
@@ -101,4 +118,25 @@ services_ip_cidr_range = "10.2.0.0/20"
 
 public_bucket_names = ["website-artifacts"]
 standard_bucket_names = []
-bucket_admins = ["[email protected]", "[email protected]"]
+bucket_admins = ["[email protected]", "[email protected]"]
+
+workload_identity_pools = {
+  "dev-pool" = {
+    display_name = "Production Identity Pool"
+    providers = {
+      "github" = {
+        issuer_uri = "https://token.actions.githubusercontent.com"
+        attribute_mapping = {
+          "google.subject" = "assertion.sub"
+          "attribute.repository" = "assertion.repository"
+          "attribute.repository_owner" = "assertion.repository_owner"
+        }
+      }
+    }
+    service_accounts = {
+      "prod-github-actions-sa" = [
+        "Significant-Gravitas/AutoGPT"
+      ]
+    }
+  }
+}