Support login via Direct Workload Identity Federation

[cbini]

Description

v2 of the Google auth action allows for "direct" WIF, which drops the intermediate dependency of needing a service account. However, there doesn't appear to be a way to pass the credentials file or auth token it generates to the login action.

https://github.com/google-github-actions/auth#direct-wif

[bjornherder]

It is possible by adding the argument token_format: "access_token" to the google-github-actions/auth@v2 action. Here is a link to the docs.

The access token can then be supplied through the password argument, i.e. password: "${{ steps.auth.outputs.access_token }}"

[mozisan]

This works for me.

- uses: google-github-actions/auth@v2
  with:
    project_id: ...
    workload_identity_provider: ...
- run: gcloud auth configure-docker ${{ secrets.MY_REGISTRY }}

[cbini]

This works for me.

- uses: google-github-actions/auth@v2
  with:
    project_id: ...
    workload_identity_provider: ...
- run: gcloud auth configure-docker ${{ secrets.MY_REGISTRY }}

Thanks for this! Figured I could use the Docker login action, but I'll give this a try.

[cbini]

@mozisan do you have a full workflow example you could share? I'm trying gcloud auth configure-docker, but the docker/build-push-action is still failing with:

ERROR: failed to push us-central1-docker.pkg.dev/.../.../...: failed to authorize: failed to fetch oauth token: unexpected status from GET request to https://us-central1-docker.pkg.dev/v2/token?scope=repository%3A...%2F...%2F...%3Apull%2Cpush&service=us-central1-docker.pkg.dev: 403 Forbidden

(my repo-specific info removed)

EDIT: my issue was Step 5 -- the workload identity pool principalSet needed the IAM binding with artifact registry permissions

[cbini]

Closing, as I no longer use this action after this resolution. Not sure if there's a way to integrate using the gcloud credHelper into the action, but maybe it could be helpful in the future.

[JordanP]

google-github-actions/setup-gcloud@v2 is a pretty heavy action. It would be great to have a solution using only this docker/login-action. AFAIK the solution provided here does not use Direct WIF but use Workload Identity Federation through a Service Account.

[JordanP]

Actually it is supported. See here for a working example.