github gcp workload pool identity federation

To allow passwordless authentication to gcp from github, we need to setup workload identity pool. To do that we can use the following command

gcloud iam workload-identity-pools create "github-pool" \

    --location="global" \

    --display-name="GitHub Actions Pool"

And then setup integration to your repo 

gcloud iam workload-identity-pools providers create-oidc "kepungnzai" \

    --location="global" \

    --workload-identity-pool="github-pool" \

    --display-name="GitHub Actions Provider" \

    --issuer-uri="https://token.actions.githubusercontent.com" \

    --attribute-mapping="google.subject=assertion.sub,attribute.repository=assertion.repository,attribute.actor=assertion.actor" \

    --attribute-condition="attribute.repository == 'kepungnzai/agentic-a2a-weather-currency'"

And all you need is yaml to deploy. Please replace the variables in the yaml. Project-ID is not the same as project number.  GCP_SERVICE_ACCOUNT should be the service account + email.  

WIF_POOL_ID should be github-pool

CICD_PROJECT_ID is should be your gcp "project-xxxxxx". 

WIF_PROVIDER_ID should be "kepungnzai" 

name: Deploy to Staging

on:

  push:

    branches:

      - main

    paths:

      - 'app/**'

      - 'data_ingestion/**'

      - 'tests/**'

      - 'deployment/**'

      - 'uv.lock'

jobs:

  deploy_and_test_staging:

    runs-on: ubuntu-latest

    permissions:

      contents: 'read'

      id-token: 'write'

    steps:

      - name: Checkout code

        uses: actions/checkout@v4

      - name: Set up Python 3.12

        uses: actions/setup-python@v4

        with:

          python-version: '3.12'

      - id: 'auth'

        name: 'Authenticate to Google Cloud'

        uses: 'google-github-actions/auth@v2'

        with:

          workload_identity_provider: 'projects/${{ vars.GCP_PROJECT_NUMBER }}/

locations/global/workloadIdentityPools/${{ secrets.WIF_POOL_ID }}/

providers/${{ secrets.WIF_PROVIDER_ID }}'

          service_account: '${{ secrets.GCP_SERVICE_ACCOUNT }}'

          create_credentials_file: true

          project_id: ${{ vars.CICD_PROJECT_ID }}