Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add guide for using workload identity federation #349

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add guide for using workload identity federation #349

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,45 @@ jobs:
channelId: live
```

### Authenticate using Workload Identity Federation

Managing service account keys poses a security risk. Workload Identity Federation can be used to reduce the risk when running GitHub Actions.
With identity federation, GitHub will generate a JWT that will be used to authenticate against Google Cloud APIs.

Before setting up your GitHub Action, you need to follow these steps to prepare your Workload Identity Pool:
https://github.com/google-github-actions/auth?tab=readme-ov-file#workload-identity-federation-through-a-service-account

```yaml
jobs:
deploy_using_workload_identity_federatoin:
runs-on: ubuntu-latest
permissions:
contents: 'read'
id-token: 'write' # This permission is needed
steps:
- uses: actions/checkout@v2

# Add these two steps to generate the credential to use with the `action-hosting-deploy` action.
- name: Prepare Google Cloud authentication
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This step seems to be missing id: auth otherwise I think ${{ steps.auth.outputs.credentials_file_path }} won't work below.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- name: Prepare Google Cloud authentication
- name: Prepare Google Cloud authentication
id: auth

uses: 'google-github-actions/auth@v2'
with:
service_account: 'service-account@your-project.iam.gserviceaccount.com'
workload_identity_provider: 'projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github/providers/github-your-org'
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
workload_identity_provider: 'projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github/providers/github-your-org'
workload_identity_provider: 'projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github/providers/github-your-org'
token_format: 'access_token'
access_token_scopes: 'email,openid,https://www.googleapis.com/auth/cloudplatformprojects.readonly,https://www.googleapis.com/auth/firebase,https://www.googleapis.com/auth/cloud-platform'

This is what we are using 🤔

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if all of the scopes are strictly necessary

create_credentials_file: true
- name: Get federated identity credentials file
run: |
echo "SERVICE_ACCOUNT_KEY=$(cat "${{ steps.auth.outputs.credentials_file_path }}" | tr -d '\n')" >> $GITHUB_ENV
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI this will silently fail if ${{ steps.auth.outputs.credentials_file_path }} resolves to something invalid oder to ''.


# Add any build steps here. For example:
# - run: npm ci && npm run build
- uses: FirebaseExtended/action-hosting-deploy@v0
with:
repoToken: "${{ secrets.GITHUB_TOKEN }}"
firebaseServiceAccount: "${{ env.SERVICE_ACCOUNT_KEY }}" # This line is different than usual !!
projectId: your-Firebase-project-ID
channelId: live
```

## Options

### `firebaseServiceAccount` _{string}_ (required)
Expand Down