From 66fdc0039c0eaa875a655b45f8ad50a6a3b0df42 Mon Sep 17 00:00:00 2001 From: Tsavo Knott Date: Mon, 15 Jun 2026 15:58:28 -0400 Subject: [PATCH 1/2] ci: migrate GCP auth to keyless Workload Identity Federation Replace the static GCP service-account key (GCP_CREDENTIALS) with keyless Workload Identity Federation, per the org-wide incident remediation. The static key behind GCP_CREDENTIALS was leaked and deleted, breaking CI. - build.yaml: auth step now uses google-github-actions/auth@v3 with workload_identity_provider + service_account (no credentials_json), and adds id-token: write / contents: read permissions to the push-build job. - Fix undeclared `project_id` input: the auth step referenced ${{ inputs.project_id }} which was never declared (resolved to empty). Pin project_id to integration-server-326115 (home of the CI SA and the app-releases-* GCS buckets). - Drop the now-unused credentials_json secret from build.yaml and remove the GCP_CREDENTIALS pass-through from staging.yaml and release.yaml. Co-authored-by: Cursor --- .github/workflows/build.yaml | 14 ++++++++------ .github/workflows/release.yaml | 1 - .github/workflows/staging.yaml | 1 - 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index b646de04..6341e03b 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -16,8 +16,6 @@ on: required: false ssh_private_key: required: true - credentials_json: - required: false apple_app_specific_password: required: false fastlane_password: @@ -347,6 +345,9 @@ jobs: # if: github.ref == 'refs/heads/main' needs: - build + permissions: + id-token: write + contents: read steps: ### Checking out our Repo to get pyproject.toml and other files - uses: actions/checkout@v3 @@ -358,12 +359,13 @@ jobs: - name: List run: ls -la - ### Authenticating with gcloud + ### Authenticating with gcloud via keyless Workload Identity Federation - name: Authenticate with Google cloud - uses: google-github-actions/auth@v2 + uses: google-github-actions/auth@v3 with: - credentials_json: ${{ secrets.credentials_json }} - project_id: ${{ inputs.project_id }} + project_id: integration-server-326115 + workload_identity_provider: projects/497784144587/locations/global/workloadIdentityPools/github-pool/providers/github-provider + service_account: github-actions@integration-server-326115.iam.gserviceaccount.com create_credentials_file: true ### Setting up gcloud cli diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index b4cd1890..6d5972ee 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -15,7 +15,6 @@ jobs: pypi_token: ${{ secrets.PYPI_TOKEN }} pypi_test_token: ${{ secrets.PYPI_TEST_TOKEN }} ssh_private_key: ${{ secrets.SSH_PRIVATE_KEY }} - credentials_json: ${{ secrets.GCP_CREDENTIALS }} apple_app_specific_password: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} fastlane_password: ${{ secrets.FASTLANE_PASSWORD }} match_password: ${{ secrets.MATCH_PASSWORD }} diff --git a/.github/workflows/staging.yaml b/.github/workflows/staging.yaml index abdfff27..c6b81625 100644 --- a/.github/workflows/staging.yaml +++ b/.github/workflows/staging.yaml @@ -16,7 +16,6 @@ jobs: pypi_token: ${{ secrets.PYPI_TOKEN }} pypi_test_token: ${{ secrets.PYPI_TEST_TOKEN }} ssh_private_key: ${{ secrets.SSH_PRIVATE_KEY }} - credentials_json: ${{ secrets.GCP_CREDENTIALS }} apple_app_specific_password: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} fastlane_password: ${{ secrets.FASTLANE_PASSWORD }} match_password: ${{ secrets.MATCH_PASSWORD }} From 7a2069175193ba3351edc916983cb63f463f8029 Mon Sep 17 00:00:00 2001 From: Tsavo Knott Date: Mon, 15 Jun 2026 16:50:46 -0400 Subject: [PATCH 2/2] ci: grant id-token permission on reusable-workflow callers The reusable build.yaml requests id-token: write for WIF auth, but a called workflow's token is capped by the caller. staging.yaml and release.yaml had no permissions block on the build job, so id-token defaulted to none and push-build OIDC auth would fail with "requesting 'id-token: write', but is only allowed 'id-token: none'". Add permissions: { id-token: write, contents: read } to the calling job in both, matching the builds_client/builds_server pattern. Co-authored-by: Cursor --- .github/workflows/release.yaml | 3 +++ .github/workflows/staging.yaml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 6d5972ee..5d14ea33 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -8,6 +8,9 @@ on: jobs: build: uses: ./.github/workflows/build.yaml + permissions: + id-token: write + contents: read with: deploy: true secrets: diff --git a/.github/workflows/staging.yaml b/.github/workflows/staging.yaml index c6b81625..5ae14c9c 100644 --- a/.github/workflows/staging.yaml +++ b/.github/workflows/staging.yaml @@ -9,6 +9,9 @@ on: jobs: build: uses: ./.github/workflows/build.yaml + permissions: + id-token: write + contents: read with: deploy: false secrets: