ci: switch env sync to deploy sa

Author: Pigbibi

.github/workflows/sync-cloud-run-env.yml

@@ -7,7 +7,7 @@ on:
 env:
   GCP_PROJECT_ID: longbridgequant
   GCP_WORKLOAD_IDENTITY_PROVIDER: projects/252919773759/locations/global/workloadIdentityPools/github-actions/providers/github-main
-  GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT: longbridge-platform-build@longbridgequant.iam.gserviceaccount.com
+  GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT: longbridge-platform-deploy@longbridgequant.iam.gserviceaccount.com
 
 jobs:
   sync-hk:

tests/test_sync_cloud_run_env_workflow.sh

@@ -4,11 +4,16 @@ set -euo pipefail
 repo_dir="$(cd "$(dirname "$0")/.." && pwd)"
 workflow_file="$repo_dir/.github/workflows/sync-cloud-run-env.yml"
 
+grep -Fq 'GCP_WORKLOAD_IDENTITY_PROVIDER: projects/252919773759/locations/global/workloadIdentityPools/github-actions/providers/github-main' "$workflow_file"
+grep -Fq 'GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT: longbridge-platform-deploy@longbridgequant.iam.gserviceaccount.com' "$workflow_file"
+grep -Fq 'permissions:' "$workflow_file"
+grep -Fq 'id-token: write' "$workflow_file"
+grep -Fq 'workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}' "$workflow_file"
+grep -Fq 'service_account: ${{ env.GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT }}' "$workflow_file"
 grep -Fq "environment: longbridge-hk" "$workflow_file"
 grep -Fq "environment: longbridge-sg" "$workflow_file"
 grep -Fq 'ENABLE_GITHUB_ENV_SYNC: ${{ vars.ENABLE_GITHUB_ENV_SYNC }}' "$workflow_file"
 grep -Fq 'GLOBAL_TELEGRAM_CHAT_ID: ${{ vars.GLOBAL_TELEGRAM_CHAT_ID }}' "$workflow_file"
-grep -Fq 'GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}' "$workflow_file"
 grep -Fq 'TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}' "$workflow_file"
 grep -Fq 'TELEGRAM_TOKEN_SECRET_NAME: ${{ vars.TELEGRAM_TOKEN_SECRET_NAME }}' "$workflow_file"
 grep -Fq 'LONGPORT_APP_KEY_SECRET_NAME: ${{ vars.LONGPORT_APP_KEY_SECRET_NAME }}' "$workflow_file"
@@ -17,8 +22,7 @@ grep -Fq 'LONGPORT_SECRET_NAME: ${{ vars.LONGPORT_SECRET_NAME }}' "$workflow_fil
 grep -Fq "STRATEGY_PROFILE: \${{ vars.STRATEGY_PROFILE || 'semiconductor_rotation_income' }}" "$workflow_file"
 grep -Fq "ACCOUNT_REGION: \${{ vars.ACCOUNT_REGION || 'HK' }}" "$workflow_file"
 grep -Fq "ACCOUNT_REGION: \${{ vars.ACCOUNT_REGION || 'SG' }}" "$workflow_file"
-grep -Fq 'credentials_json: ${{ env.GCP_SA_KEY }}' "$workflow_file"
-grep -Fq "echo \"enabled=false\" >> \"\$GITHUB_OUTPUT\"" "$workflow_file"
+grep -Fq 'echo "enabled=false" >> "$GITHUB_OUTPUT"' "$workflow_file"
 grep -Fq "Skipping HK Cloud Run env sync because ENABLE_GITHUB_ENV_SYNC is not set to true." "$workflow_file"
 grep -Fq "Skipping SG Cloud Run env sync because ENABLE_GITHUB_ENV_SYNC is not set to true." "$workflow_file"
 grep -Fq "HK Cloud Run env sync is enabled, but these values are missing:" "$workflow_file"