step-security/Authenticate to Google Cloud

Authenticate to Google Cloud from GitHub Actions via Workload Identity Federation or service account keys.

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Stale
License
None
namedescriptionrequireddefault
project_idID of the default project to use for future API calls and invocations. If unspecified, this action will attempt to extract the value from other inputs such as "service_account" or "credentials_json".no
workload_identity_providerThe full identifier of the Workload Identity Provider, including the project number, pool name, and provider name. If provided, this must be the full identifier which includes all parts, for example: "projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider". This is mutually exclusive with "credentials_json".no
service_accountEmail address or unique identifier of the Google Cloud service account for which to generate credentials. This is required if "workload_identity_provider" is specified.no
audienceThe value for the audience (aud) parameter in GitHub's generated OIDC token. This value defaults to the value of "workload_identity_provider", which is also the default value Google Cloud expects for the audience parameter on the token.no""
credentials_jsonThe Google Cloud JSON service account key to use for authentication. This is mutually exclusive with "workload_identity_provider".no
create_credentials_fileIf true, the action will securely generate a credentials file which can be used for authentication via gcloud and Google Cloud SDKs.notrue
export_environment_variablesIf true, the action will export common environment variables which are known to be consumed by popular downstream libraries and tools, including: - CLOUDSDK_PROJECT - CLOUDSDK_CORE_PROJECT - GCP_PROJECT - GCLOUD_PROJECT - GOOGLE_CLOUD_PROJECT If "create_credentials_file" is true, additional environment variables are exported: - CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE - GOOGLE_APPLICATION_CREDENTIALS - GOOGLE_GHA_CREDS_PATH If false, the action will not export any environment variables, meaning future steps are unlikely to be automatically authenticated to Google Cloud.notrue
token_formatOutput format for the generated authentication token. For OAuth 2.0 access tokens, specify "access_token". For OIDC tokens, specify "id_token". To skip token generation, leave this value empty.no""
delegatesList of additional service account emails or unique identities to use for impersonation in the chain.no""
universeThe Google Cloud universe to use for constructing API endpoints. The default universe is "googleapis.com", which corresponds to https://cloud.google.com. Trusted Partner Cloud and Google Distributed Hosted Cloud should set this to their universe address.nogoogleapis.com
request_reasonAn optional Reason Request System Parameter for each API call made by the GitHub Action. This will inject the "X-Goog-Request-Reason" HTTP header, which will provide user-supplied information in Google Cloud audit logs.no
cleanup_credentialsIf true, the action will remove any created credentials from the filesystem upon completion. This only applies if "create_credentials_file" is true.notrue
access_token_lifetimeDesired lifetime duration of the access token, in seconds. This must be specified as the number of seconds with a trailing "s" (e.g. 30s). This is only valid when "token_format" is "access_token".no3600s
access_token_scopesList of OAuth 2.0 access scopes to be included in the generated token. This is only valid when "token_format" is "access_token".nohttps://www.googleapis.com/auth/cloud-platform
access_token_subjectEmail address of a user to impersonate for Domain-Wide Delegation Access tokens created for Domain-Wide Delegation cannot have a lifetime beyond 1 hour. This is only valid when "token_format" is "access_token".no""
id_token_audienceThe audience (aud) for the generated Google Cloud ID Token. This is only valid when "token_format" is "id_token".no""
id_token_include_emailOptional parameter of whether to include the service account email in the generated token. If true, the token will contain "email" and "email_verified" claims. This is only valid when "token_format" is "id_token".nofalse
namedescription
project_idProvided or extracted value for the Google Cloud project ID.
credentials_file_pathPath on the local filesystem where the generated credentials file resides. This is only available if "create_credentials_file" was set to true.
auth_tokenThe intermediate authentication token, which could be used to call other Google Cloud APIs, depending on how you configured IAM.
access_tokenThe Google Cloud access token for calling other Google Cloud APIs. This is only available when "token_format" is "access_token".
id_tokenThe Google Cloud ID token. This is only available when "token_format" is "id_token".