Repository navigation
chore(ci): publish to GCP via Workload Identity Federation instead of an SA key - #458
Merged
Merged
Conversation
gsutil is in maintenance mode and does not reliably pick up the external-account credentials that Workload Identity Federation produces. gcloud storage uses the gcloud credential directly. The existence check keeps the same semantics: any non-zero exit (missing or forbidden) falls through to the upload. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jcalero
marked this pull request as ready for review
October 29, 2026 11:10
Replace the long-lived service-account key with GitHub OIDC tokens. The publish job now runs in the `release` environment, which only release tags can deploy to. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jcalero
force-pushed
the
publish-wif-auth
branch
from
October 29, 2026 11:16
bca988b to
562d93c
Compare
anachili
approved these changes
Oct 29, 2026
anachili
left a comment
anachili
left a comment
Contributor
There was a problem hiding this comment.
approved with a clarifying question
Comment on lines
+17
to
+18
| # Only v* tags may deploy to this environment, and only admins and | ||
| # maintainers may create those tags. GCP trusts OIDC tokens from this |
Contributor
There was a problem hiding this comment.
Can you confirm the "Release tags" ruleset has the admin role (or specific people) in its bypass list? With write access I can't see the list, and rulesets apply to admins too unless they're listed. If it's empty, nobody can create a v* tag and the next release will fail at tagging. Also, the repo has no one with the maintain role, so in practice this means admins only.
Contributor
Author
There was a problem hiding this comment.
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The publish workflow authenticates to GCP with a long-lived service-account key held in a repository secret. This switches it to short-lived OIDC tokens via Workload Identity Federation, so there is no static credential left to manage or rotate.
google-github-actions/auth@v2exchanges the job's GitHub OIDC token for a short-lived GCP token.releaseenvironment. The job now targets thereleaseenvironment, which onlyv*tags can deploy to. A tag ruleset limits creating, moving or deletingv*tags to admins and maintainers.gsutil→gcloud storage. gcloud uses the federated credential directly. The existence check before each upload behaves as before.The GCP and environment configuration is already in place, so merging this has no effect until the next release.
Test plan
GCP Authsucceeds on both matrix legs, and the binaries and .deb appear undergs://reinfer-public/cli/.🤖 Generated with Claude Code