Skip to content

Commit 8e7818b

Browse files
jeropjerop
authored
feat(auth): Simplify and unify Workload Identity configuration (#33)
Renames to to create a single, unified variable for all Google Cloud authentication. Key changes: - The now uses this unified provider for a more generic authentication step. - All documentation and workflows have been updated to use the new variable. - The script is updated to reflect the new variable name in its output. This is a follow up after #18 <!-- Thank you for proposing a pull request! Please note that SOME TESTS WILL LIKELY FAIL due to how GitHub exposes secrets in Pull Requests from forks. Someone from the team will review your Pull Request and respond. Please describe your change and any implementation details below. -->
1 parent 1574bf3 commit 8e7818b

15 files changed

+42
-55
lines changed

‎.github/workflows/gemini-cli.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,7 @@ jobs:
174174
ISSUE_NUMBER: '${{ steps.get_context.outputs.issue_number }}'
175175
IS_PR: '${{ steps.get_context.outputs.is_pr }}'
176176
GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
177-
OTLP_GCP_WIF_PROVIDER: '${{ vars.OTLP_GCP_WIF_PROVIDER }}'
177+
GCP_WIF_PROVIDER: '${{ vars.GCP_WIF_PROVIDER }}'
178178
OTLP_GOOGLE_CLOUD_PROJECT: '${{ vars.OTLP_GOOGLE_CLOUD_PROJECT }}'
179179
GOOGLE_CLOUD_PROJECT: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
180180
GOOGLE_CLOUD_LOCATION: '${{ vars.GOOGLE_CLOUD_LOCATION }}'

‎.github/workflows/gemini-issue-automated-triage.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ jobs:
6565
REPOSITORY: '${{ github.repository }}'
6666
GEMINI_CLI_VERSION: '${{ vars.GEMINI_CLI_VERSION }}'
6767
OTLP_GOOGLE_CLOUD_PROJECT: '${{ vars.OTLP_GOOGLE_CLOUD_PROJECT }}'
68-
OTLP_GCP_WIF_PROVIDER: '${{ vars.OTLP_GCP_WIF_PROVIDER }}'
68+
GCP_WIF_PROVIDER: '${{ vars.GCP_WIF_PROVIDER }}'
6969
GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
7070
GOOGLE_CLOUD_PROJECT: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
7171
GOOGLE_CLOUD_LOCATION: '${{ vars.GOOGLE_CLOUD_LOCATION }}'

‎.github/workflows/gemini-issue-scheduled-triage.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ jobs:
7373
REPOSITORY: '${{ github.repository }}'
7474
GEMINI_CLI_VERSION: '${{ vars.GEMINI_CLI_VERSION }}'
7575
OTLP_GOOGLE_CLOUD_PROJECT: '${{ vars.OTLP_GOOGLE_CLOUD_PROJECT }}'
76-
OTLP_GCP_WIF_PROVIDER: '${{ vars.OTLP_GCP_WIF_PROVIDER }}'
76+
GCP_WIF_PROVIDER: '${{ vars.GCP_WIF_PROVIDER }}'
7777
GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
7878
GOOGLE_CLOUD_PROJECT: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
7979
GOOGLE_CLOUD_LOCATION: '${{ vars.GOOGLE_CLOUD_LOCATION }}'

‎.github/workflows/gemini-pr-review.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ jobs:
152152
REPOSITORY: '${{ github.repository }}'
153153
GEMINI_CLI_VERSION: '${{ vars.GEMINI_CLI_VERSION }}'
154154
OTLP_GOOGLE_CLOUD_PROJECT: '${{ vars.OTLP_GOOGLE_CLOUD_PROJECT }}'
155-
OTLP_GCP_WIF_PROVIDER: '${{ vars.OTLP_GCP_WIF_PROVIDER }}'
155+
GCP_WIF_PROVIDER: '${{ vars.GCP_WIF_PROVIDER }}'
156156
GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
157157
GOOGLE_CLOUD_PROJECT: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
158158
GOOGLE_CLOUD_LOCATION: '${{ vars.GOOGLE_CLOUD_LOCATION }}'

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ Set the following environment variables in your repository or workflow:
7979
| Name | Description | Type | Required | When Required |
8080
|---------------------------|---------------------------------------------------------------------------------------------|----------|----------|------------------------------|
8181
| GEMINI_CLI_VERSION | Controls which version of the Gemini CLI is installed. Supports npm versions (e.g., `0.1.0`, `latest`), a branch name (e.g., `main`), or a commit hash. | Variable | No | To pin or override CLI version |
82-
| OTLP_GCP_WIF_PROVIDER | The full resource name of the Workload Identity Provider. | Variable | No | If using observability |
82+
| GCP_WIF_PROVIDER | The full resource name of the Workload Identity Provider. | Variable | No | If using observability |
8383
| OTLP_GOOGLE_CLOUD_PROJECT | The Google Cloud project for telemetry. | Variable | No | If using observability |
8484
| GOOGLE_CLOUD_PROJECT | The Google Cloud project for Vertex auth. | Variable | No | If using Vertex auth |
8585
| GOOGLE_CLOUD_LOCATION | The location of the Google Cloud project for Vertex auth. | Variable | No | If using Vertex auth |

‎action.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,18 +46,18 @@ runs:
4646
env:
4747
SETTINGS: '${{ inputs.settings }}'
4848

49-
- name: 'Authenticate to Google Cloud for Telemetry'
49+
- name: 'Authenticate to Google Cloud'
5050
if: |-
51-
${{ env.OTLP_GCP_WIF_PROVIDER != '' }}
51+
${{ env.GCP_WIF_PROVIDER != '' }}
5252
id: 'auth'
5353
uses: 'google-github-actions/auth@v2'
5454
with:
55-
project_id: '${{ env.OTLP_GOOGLE_CLOUD_PROJECT }}'
56-
workload_identity_provider: '${{ env.OTLP_GCP_WIF_PROVIDER }}'
55+
project_id: '${{ env.GOOGLE_CLOUD_PROJECT }}'
56+
workload_identity_provider: '${{ env.GCP_WIF_PROVIDER }}'
5757

5858
- name: 'Run Telemetry Collector for Google Cloud'
5959
if: |-
60-
${{ env.OTLP_GCP_WIF_PROVIDER != '' }}
60+
${{ env.GCP_WIF_PROVIDER != '' }}
6161
env:
6262
OTLP_GOOGLE_CLOUD_PROJECT: '${{ env.OTLP_GOOGLE_CLOUD_PROJECT }}'
6363
GITHUB_ACTION_PATH: '${{ github.action_path }}'

‎docs/observability.md‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,15 +49,9 @@ For advanced configuration options, manual setup instructions, troubleshooting,
4949
After running the setup script, configure your GitHub Actions workflow with the provided values:
5050

5151
```yaml
52-
- uses: google-github-actions/auth@v2
53-
with:
54-
workload_identity_provider: ${{ vars.OTLP_GCP_WIF_PROVIDER }}
55-
project_id: ${{ vars.OTLP_GOOGLE_CLOUD_PROJECT }}
56-
57-
5852
- uses: google-github-actions/run-gemini-cli@v1
5953
env:
60-
OTLP_GCP_WIF_PROVIDER: ${{ vars.OTLP_GCP_WIF_PROVIDER }}
54+
GCP_WIF_PROVIDER: ${{ vars.GCP_WIF_PROVIDER }}
6155
OTLP_GOOGLE_CLOUD_PROJECT: ${{ vars.OTLP_GOOGLE_CLOUD_PROJECT }}
6256
GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
6357
with:

‎docs/workload-identity.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ The script automatically grants these essential permissions:
3939
- **`roles/logging.logWriter`** - Write logs to Cloud Logging
4040
- **`roles/monitoring.metricWriter`** - Write metrics to Cloud Monitoring
4141
- **`roles/cloudtrace.agent`** - Send traces to Cloud Trace
42+
- **`roles/aiplatform.user `** - Make inference calls to Vertex AI
4243

4344
## Quick Start
4445

@@ -94,11 +95,10 @@ Your user account needs these permissions in the target GCP project:
9495

9596
### What the Script Does
9697

97-
1. **Enables required APIs**: IAM, STS, Logging, Monitoring, Tracing
98-
2. **Creates Workload Identity Pool**: Shared resource (named `github` by default)
99-
3. **Creates Workload Identity Provider**: Unique per repository
100-
4. **Grants permissions**: Automatic observability permissions
101-
5. **Outputs configuration**: GitHub secrets and workflow example
98+
1. **Creates Workload Identity Pool**: Shared resource (named `github` by default)
99+
2. **Creates Workload Identity Provider**: Unique per repository
100+
3. **Grants permissions**: Automatic observability and inference permissions
101+
4. **Outputs configuration**: GitHub secrets and workflow example
102102

103103
## GitHub Configuration
104104

@@ -109,7 +109,7 @@ Go to: `https://github.com/OWNER/REPO/settings/variables/actions`
109109

110110
| Environment Variable Name | Description |
111111
|-----------------------------------|--------------------------------------------------|
112-
| `OTLP_GCP_WIF_PROVIDER` | Workload Identity Provider resource name |
112+
| `GCP_WIF_PROVIDER` | Workload Identity Provider resource name |
113113
| `OTLP_GOOGLE_CLOUD_PROJECT` | Your Google Cloud project ID |
114114
| `GOOGLE_CLOUD_PROJECT` | Your Google Cloud project ID |
115115
| `GOOGLE_CLOUD_LOCATION` | Your Google Cloud project Location |

‎scripts/setup_workload_identity.sh‎

Lines changed: 19 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -196,16 +196,8 @@ fi
196196

197197
print_success "Authentication and project access verified"
198198

199-
# Step 1: Enable required APIs
200-
print_header "Step 1: Enabling required Google Cloud APIs"
201-
apis_to_enable="iamcredentials.googleapis.com cloudresourcemanager.googleapis.com iam.googleapis.com sts.googleapis.com logging.googleapis.com monitoring.googleapis.com cloudtrace.googleapis.com"
202-
203-
print_info "Enabling APIs: ${apis_to_enable}"
204-
gcloud services enable "${apis_to_enable}" --project="${GOOGLE_CLOUD_PROJECT}"
205-
print_success "APIs enabled successfully"
206-
207-
# Step 2: Create Workload Identity Pool
208-
print_header "Step 2: Creating Workload Identity Pool"
199+
# Step 1: Create Workload Identity Pool
200+
print_header "Step 1: Creating Workload Identity Pool"
209201
if ! gcloud iam workload-identity-pools describe "${POOL_NAME}" \
210202
--project="${GOOGLE_CLOUD_PROJECT}" \
211203
--location="${GOOGLE_CLOUD_LOCATION}" &> /dev/null; then
@@ -225,8 +217,8 @@ WIF_POOL_ID=$(gcloud iam workload-identity-pools describe "${POOL_NAME}" \
225217
--location="${GOOGLE_CLOUD_LOCATION}" \
226218
--format="value(name)")
227219

228-
# Step 3: Create Workload Identity Provider
229-
print_header "Step 3: Creating Workload Identity Provider"
220+
# Step 2: Create Workload Identity Provider
221+
print_header "Step 2: Creating Workload Identity Provider"
230222
ATTRIBUTE_CONDITION="assertion.repository_owner == '${REPO_OWNER}'"
231223

232224
if ! gcloud iam workload-identity-pools providers describe "${PROVIDER_NAME}" \
@@ -247,13 +239,13 @@ else
247239
print_success "Workload Identity Provider already exists"
248240
fi
249241

250-
# Step 4: Grant standard permissions to the Workload Identity Pool
251-
print_header "Step 4: Granting standard permissions to Workload Identity Pool"
242+
# Step 3: Grant required permissions to the Workload Identity Pool
243+
print_header "Step 3: Granting required permissions to Workload Identity Pool"
252244
PRINCIPAL_SET="principalSet://iam.googleapis.com/${WIF_POOL_ID}/attribute.repository/${GITHUB_REPO}"
253245

254-
print_info "Granting standard CI/CD permissions directly to the Workload Identity Pool..."
246+
print_info "Granting required permissions directly to the Workload Identity Pool..."
255247

256-
# Core observability permissions
248+
# Observability permissions
257249
print_info "Granting logging permissions..."
258250
gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
259251
--role="roles/logging.logWriter" \
@@ -272,14 +264,14 @@ gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
272264
--member="${PRINCIPAL_SET}" \
273265
--condition=None
274266

275-
267+
# Model inference permissions
276268
print_info "Granting vertex permissions..."
277269
gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
278270
--role="roles/aiplatform.user" \
279271
--member="${PRINCIPAL_SET}" \
280272
--condition=None
281273

282-
print_success "Standard permissions granted to Workload Identity Pool"
274+
print_success "Required permissions granted to Workload Identity Pool"
283275

284276
# Get the full provider name for output
285277
WIF_PROVIDER_FULL=$(gcloud iam workload-identity-pools providers describe "${PROVIDER_NAME}" \
@@ -288,7 +280,7 @@ WIF_PROVIDER_FULL=$(gcloud iam workload-identity-pools providers describe "${PRO
288280
--workload-identity-pool="${POOL_NAME}" \
289281
--format="value(name)")
290282

291-
# Step 5: Output configuration
283+
# Step 4: Output configuration
292284
print_header "🎉 Setup Complete!"
293285
echo ""
294286
print_success "Direct Workload Identity Federation has been configured for your repository!"
@@ -300,24 +292,25 @@ print_success "The following permissions have been automatically granted to your
300292
echo "• roles/logging.logWriter - Write logs to Cloud Logging"
301293
echo "• roles/monitoring.editor - Create and update metrics in Cloud Monitoring"
302294
echo "• roles/cloudtrace.agent - Send traces to Cloud Trace"
295+
echo "• roles/aiplatform.user - Use Vertex AI for model inference"
303296
echo ""
304297

305298
print_header "GitHub Environment Variables Configuration"
306299
echo ""
307300
print_warning "Add these variables to your GitHub repository or workflow configuration:"
308301
echo " Repository: https://github.com/${GITHUB_REPO}/settings/variables/actions"
309302
echo ""
310-
echo "🔑 Variable Name: OTLP_GCP_WIF_PROVIDER"
311-
echo " Value: ${WIF_PROVIDER_FULL}"
303+
echo "🔑 Variable Name: GCP_WIF_PROVIDER"
304+
echo " Variable Value: ${WIF_PROVIDER_FULL}"
312305
echo ""
313306
echo "☁️ Variable Name: OTLP_GOOGLE_CLOUD_PROJECT"
314-
echo " Value: ${GOOGLE_CLOUD_PROJECT}"
307+
echo " Variable VariableValue: ${GOOGLE_CLOUD_PROJECT}"
315308
echo ""
316-
echo "☁️ Secret Name: GOOGLE_CLOUD_LOCATION"
317-
echo " Secret Value: ${GOOGLE_CLOUD_LOCATION}"
309+
echo "☁️ Variable Name: GOOGLE_CLOUD_PROJECT"
310+
echo " Variable Value: ${GOOGLE_CLOUD_PROJECT}"
318311
echo ""
319-
echo "☁️ Secret Name: GOOGLE_CLOUD_PROJECT"
320-
echo " Secret Value: ${GOOGLE_CLOUD_PROJECT}"
312+
echo "☁️ Variable Name: GOOGLE_CLOUD_LOCATION"
313+
echo " Variable Value: ${GOOGLE_CLOUD_LOCATION}"
321314
echo ""
322315

323316
print_success "Setup completed successfully! 🚀"

‎workflows/gemini-cli/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ When invoked with `@gemini-cli`, the assistant uses a customizable set of tools
4545
2. **GitHub App Token (Optional)**: Required for authentication if using custom github app.
4646
- Set `APP_ID` and `APP_PRIVATE_KEY` secrets in your repository.
4747
3. **Telemetry (Optional)**: For observability.
48-
- Set `OTLP_GCP_WIF_PROVIDER` secret and `OTLP_GOOGLE_CLOUD_PROJECT` variable.
48+
- Set `GCP_WIF_PROVIDER` secret and `OTLP_GOOGLE_CLOUD_PROJECT` variable.
4949

5050
### Workflow File
5151

0 commit comments

Comments
 (0)