google-github-actions/Authenticate to Google Cloud
Authenticate to Google Cloud from GitHub Actions via Workload Identity Federation or service account keys.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 8, 2026
- License
- Apache 2.0
Pinned Snippet
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| project_id | ID of the default project to use for future API calls and invocations. If unspecified, this action will attempt to extract the value from other inputs such as "service_account" or "credentials_json". | no | — |
| workload_identity_provider | The full identifier of the Workload Identity Provider, including the project number, pool name, and provider name. If provided, this must be the full identifier which includes all parts, for example: "projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider". This is mutually exclusive with "credentials_json". | no | — |
| service_account | Email address or unique identifier of the Google Cloud service account for which to generate credentials. This is required if "workload_identity_provider" is specified. | no | — |
| audience | The value for the audience (aud) parameter in GitHub's generated OIDC token. This value defaults to the value of "workload_identity_provider", which is also the default value Google Cloud expects for the audience parameter on the token. | no | "" |
| credentials_json | The Google Cloud JSON service account key to use for authentication. This is mutually exclusive with "workload_identity_provider". | no | — |
| create_credentials_file | If true, the action will securely generate a credentials file which can be used for authentication via gcloud and Google Cloud SDKs. | no | true |
| export_environment_variables | If true, the action will export common environment variables which are known to be consumed by popular downstream libraries and tools, including: - CLOUDSDK_PROJECT - CLOUDSDK_CORE_PROJECT - GCP_PROJECT - GCLOUD_PROJECT - GOOGLE_CLOUD_PROJECT If "create_credentials_file" is true, additional environment variables are exported: - CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE - GOOGLE_APPLICATION_CREDENTIALS - GOOGLE_GHA_CREDS_PATH If false, the action will not export any environment variables, meaning future steps are unlikely to be automatically authenticated to Google Cloud. | no | true |
| token_format | Output format for the generated authentication token. For OAuth 2.0 access tokens, specify "access_token". For OIDC tokens, specify "id_token". To skip token generation, leave this value empty. | no | "" |
| delegates | List of additional service account emails or unique identities to use for impersonation in the chain. | no | "" |
| universe | The Google Cloud universe to use for constructing API endpoints. The default universe is "googleapis.com", which corresponds to https://cloud.google.com. Trusted Partner Cloud and Google Distributed Hosted Cloud should set this to their universe address. | no | googleapis.com |
| request_reason | An optional Reason Request System Parameter for each API call made by the GitHub Action. This will inject the "X-Goog-Request-Reason" HTTP header, which will provide user-supplied information in Google Cloud audit logs. | no | — |
| cleanup_credentials | If true, the action will remove any created credentials from the filesystem upon completion. This only applies if "create_credentials_file" is true. | no | true |
| access_token_lifetime | Desired lifetime duration of the access token, in seconds. This must be specified as the number of seconds with a trailing "s" (e.g. 30s). This is only valid when "token_format" is "access_token". | no | 3600s |
| access_token_scopes | List of OAuth 2.0 access scopes to be included in the generated token. This is only valid when "token_format" is "access_token". | no | https://www.googleapis.com/auth/cloud-platform |
| access_token_subject | Email address of a user to impersonate for Domain-Wide Delegation Access tokens created for Domain-Wide Delegation cannot have a lifetime beyond 1 hour. This is only valid when "token_format" is "access_token". | no | "" |
| id_token_audience | The audience (aud) for the generated Google Cloud ID Token. This is only valid when "token_format" is "id_token". | no | "" |
| id_token_include_email | Optional parameter of whether to include the service account email in the generated token. If true, the token will contain "email" and "email_verified" claims. This is only valid when "token_format" is "id_token". | no | false |
Outputs
| name | description |
|---|---|
| project_id | Provided or extracted value for the Google Cloud project ID. |
| credentials_file_path | Path on the local filesystem where the generated credentials file resides. This is only available if "create_credentials_file" was set to true. |
| auth_token | The intermediate authentication token, which could be used to call other Google Cloud APIs, depending on how you configured IAM. |
| access_token | The Google Cloud access token for calling other Google Cloud APIs. This is only available when "token_format" is "access_token". |
| id_token | The Google Cloud ID token. This is only available when "token_format" is "id_token". |