Workload Identity Federation for GitHub Actions: CI with no stored keys

TL;DR

Issuer is the GitHub OIDC issuer; set attribute mapping (google.subject from assertion.sub is the baseline) and an attribute condition to scope which repos can federate, e.g. assertion.repository == '[ORG]/[REPO]'.

Steps

1. Goal: GitHub Actions deploys to GCP with zero long-lived keys.
2. Steps:
3. Create a workload identity pool:

gcloud iam workload-identity-pools create [POOL] --location global --display-name "[NAME]"

3. Create an OIDC provider for GitHub in the pool. Issuer is the GitHub OIDC issuer; set attribute mapping (google.subject from assertion.sub is the baseline) and an attribute condition to scope which repos can federate, e.g. assertion.repository == '[ORG]/[REPO]'.
4. Allow the federated identity to impersonate the target SA:

gcloud iam service-accounts add-iam-policy-binding [SA-EMAIL] --role roles/iam.workloadIdentityUser --member "principalSet://iam.googleapis.com/projects/[NUM]/locations/global/workloadIdentityPools/[POOL]/attribute.repository/[ORG]/[REPO]"

4. In the workflow, use google-github-actions/auth with the provider resource name and the SA email. No secrets needed.
5. Traps:

• Attribute condition too tight (or referencing a claim the token lacks) fails closed with unhelpful errors. Decode a real token and test the condition logic.
• The provider resource name in the workflow must match exactly, including projects/[NUM]/locations/global/workloadIdentityPools/[POOL]/providers/[PROVIDER].
• The federated identity still needs the workload's roles (storage.admin etc) via the SA it impersonates. Federation is auth, not authorization.
• Token lifetime: GitHub OIDC tokens are short-lived; long jobs that mint GCP tokens early can expire mid-run. Mint close to use.

6. Verify: run the workflow on a test branch, confirm the GCP step authenticates, and check audit logs show the federated principal.

When to use

You are seeing this: Goal: GitHub Actions deploys to GCP with zero long-lived keys. Use this skill when you run into "Workload Identity Federation for GitHub Actions: CI with no stored keys".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Verified 2026-09-26 on the WIF docs: pool/provider model, attribute mapping and conditions, workloadIdentityUser binding, and GitHub listed as a supported OIDC deployment service. The auth action pattern is the documented GitHub integration.