ci(google-auth): use workload identity federation instead of json

ibis-project · Oct 21, 2024 · ba0cee5 · ba0cee5
1 parent 4491a89
commit ba0cee5
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 8 deletions.
diff --git a/.github/workflows/ci-data.yml b/.github/workflows/ci-data.yml
@@ -42,7 +42,7 @@ jobs:
 
       - uses: google-github-actions/auth@v2
         with:
-          credentials_json: ${{ secrets.GCP_CREDENTIALS }}
+          workload_identity_provider: "${{ secrets.WIF_PROVIDER_NAME }}"
 
       - uses: google-github-actions/setup-gcloud@v2
 

diff --git a/.github/workflows/ibis-backends-cloud.yml b/.github/workflows/ibis-backends-cloud.yml
@@ -15,11 +15,6 @@ on:
     types:
       - labeled
 
-permissions:
-  # this allows extractions/setup-just to list releases for `just` at a higher
-  # rate limit while restricting GITHUB_TOKEN permissions elsewhere
-  contents: read
-
 env:
   FORCE_COLOR: "1"
   SQLALCHEMY_WARN_20: "1"
@@ -75,6 +70,13 @@ jobs:
               key: snowpark
               extras:
                 - snowflake
+    # this allows extractions/setup-just to list releases for `just` at a higher
+    # rate limit while restricting GITHUB_TOKEN permissions elsewhere
+    permissions:
+      contents: "read"
+      # required for GCP workload identity federation
+      id-token: "write"
+
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -125,7 +127,7 @@ jobs:
 
       - uses: google-github-actions/auth@v2
         with:
-          credentials_json: ${{ secrets.GCP_CREDENTIALS }}
+          workload_identity_provider: "${{ secrets.WIF_PROVIDER_NAME }}"
 
       - name: setup snowflake credentials
         if: matrix.backend.name == 'snowflake'

diff --git a/.github/workflows/ibis-benchmarks.yml b/.github/workflows/ibis-benchmarks.yml
@@ -46,7 +46,7 @@ jobs:
 
       - uses: google-github-actions/auth@v2
         with:
-          credentials_json: ${{ secrets.GCP_CREDENTIALS }}
+          workload_identity_provider: "${{ secrets.WIF_PROVIDER_NAME }}"
 
       - uses: google-github-actions/setup-gcloud@v2