| project_id | ID of the default project to use for future API calls and invocations. If
unspecified, this action will attempt to extract the value from other
inputs such as "service_account" or "credentials_json". | no | — |
| workload_identity_provider | The full identifier of the Workload Identity Provider, including the
project number, pool name, and provider name. If provided, this must be
the full identifier which includes all parts, for example:
"projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider".
This is mutually exclusive with "credentials_json". | no | — |
| service_account | Email address or unique identifier of the Google Cloud service account for
which to generate credentials. This is required if
"workload_identity_provider" is specified. | no | — |
| audience | The value for the audience (aud) parameter in GitHub's generated OIDC
token. This value defaults to the value of "workload_identity_provider",
which is also the default value Google Cloud expects for the audience
parameter on the token. | no | "" |
| credentials_json | The Google Cloud JSON service account key to use for authentication. This
is mutually exclusive with "workload_identity_provider". | no | — |
| create_credentials_file | If true, the action will securely generate a credentials file which can be
used for authentication via gcloud and Google Cloud SDKs. | no | true |
| export_environment_variables | If true, the action will export common environment variables which are
known to be consumed by popular downstream libraries and tools, including:
- CLOUDSDK_PROJECT
- CLOUDSDK_CORE_PROJECT
- GCP_PROJECT
- GCLOUD_PROJECT
- GOOGLE_CLOUD_PROJECT
If "create_credentials_file" is true, additional environment variables are
exported:
- CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE
- GOOGLE_APPLICATION_CREDENTIALS
- GOOGLE_GHA_CREDS_PATH
If false, the action will not export any environment variables, meaning
future steps are unlikely to be automatically authenticated to Google
Cloud. | no | true |
| token_format | Output format for the generated authentication token. For OAuth 2.0 access
tokens, specify "access_token". For OIDC tokens, specify "id_token". To
skip token generation, leave this value empty. | no | "" |
| delegates | List of additional service account emails or unique identities to use for
impersonation in the chain. | no | "" |
| universe | The Google Cloud universe to use for constructing API endpoints. The
default universe is "googleapis.com", which corresponds to
https://cloud.google.com. Trusted Partner Cloud and Google Distributed
Hosted Cloud should set this to their universe address. | no | googleapis.com |
| request_reason | An optional Reason Request System Parameter for each API call made by the
GitHub Action. This will inject the "X-Goog-Request-Reason" HTTP header,
which will provide user-supplied information in Google Cloud audit logs. | no | — |
| cleanup_credentials | If true, the action will remove any created credentials from the
filesystem upon completion. This only applies if "create_credentials_file"
is true. | no | true |
| access_token_lifetime | Desired lifetime duration of the access token, in seconds. This must be
specified as the number of seconds with a trailing "s" (e.g. 30s). This is
only valid when "token_format" is "access_token". | no | 3600s |
| access_token_scopes | List of OAuth 2.0 access scopes to be included in the generated token.
This is only valid when "token_format" is "access_token". | no | https://www.googleapis.com/auth/cloud-platform |
| access_token_subject | Email address of a user to impersonate for Domain-Wide Delegation Access
tokens created for Domain-Wide Delegation cannot have a lifetime beyond 1
hour. This is only valid when "token_format" is "access_token". | no | "" |
| id_token_audience | The audience (aud) for the generated Google Cloud ID Token. This is only
valid when "token_format" is "id_token". | no | "" |
| id_token_include_email | Optional parameter of whether to include the service account email in the
generated token. If true, the token will contain "email" and
"email_verified" claims. This is only valid when "token_format" is
"id_token". | no | false |