ci: add missing id-token:write permission for Google Cloud (#1276)

* ci: add missing id-token permission for gc auth Signed-off-by: KeisukeYamashita <[email protected]> * ci: add missing `actions/checkout` before google cloud auth Signed-off-by: KeisukeYamashita <[email protected]> --------- Signed-off-by: KeisukeYamashita <[email protected]>
reearth · Oct 20, 2024 · f27d508 · f27d508
1 parent e828520
commit f27d508
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 5 deletions.
diff --git a/.github/workflows/cron_ion_token_test.yml b/.github/workflows/cron_ion_token_test.yml
@@ -9,11 +9,16 @@ env:
 jobs:
   update_ion_token:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # To checkout
+      id-token: write # To authenticate with Google Cloud using OIDC
     steps:
+      - uses: actions/checkout@v4
+
       - uses: google-github-actions/auth@v2
         with:
           service_account: ${{ secrets.GCP_SA_EMAIL }}
-          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER}}
+          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
       - name: Set up Cloud SDK
         uses: google-github-actions/setup-gcloud@v2
       - name: Download reearth config

diff --git a/.github/workflows/deploy_test.yml b/.github/workflows/deploy_test.yml
@@ -34,6 +34,9 @@ jobs:
     name: Deploy web to test env
     if: github.event.repository.full_name == 'reearth/reearth-cms' && github.event.workflow_run.name == 'ci-web' && github.event.workflow_run.conclusion != 'failure' && github.event.workflow_run.head_branch == 'main'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # To checkout
+      id-token: write # To authenticate with Google Cloud using OIDC
     steps:
       - uses: actions/create-github-app-token@v1
         id: app-token
@@ -56,7 +59,7 @@ jobs:
       - uses: google-github-actions/auth@v2
         with:
           service_account: ${{ secrets.GCP_SA_EMAIL }}
-          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER}}
+          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
       - name: Set up Cloud SDK
         uses: google-github-actions/setup-gcloud@v2
       - name: Deploy
@@ -66,13 +69,16 @@ jobs:
     name: Deploy server to test env
     runs-on: ubuntu-latest
     if: github.event.repository.full_name == 'reearth/reearth-cms' && github.event.workflow_run.name == 'server-build' && github.event.workflow_run.conclusion != 'failure' && github.event.workflow_run.head_branch == 'main'
+    permissions:
+      contents: read # To checkout
+      id-token: write # To authenticate with Google Cloud using OIDC
     steps:
       - uses: actions/checkout@v4
 
       - uses: google-github-actions/auth@v2
         with:
           service_account: ${{ secrets.GCP_SA_EMAIL }}
-          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER}}
+          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
       - name: Set up Cloud SDK
         uses: google-github-actions/setup-gcloud@v2
       - name: Configure docker
@@ -94,13 +100,16 @@ jobs:
     name: Deploy web to test env
     runs-on: ubuntu-latest
     if: github.event.repository.full_name == 'reearth/reearth-cms' && github.event.workflow_run.name == 'web-build' && github.event.workflow_run.conclusion != 'failure' && github.event.workflow_run.head_branch == 'main'
+    permissions:
+      contents: read # To checkout
+      id-token: write # To authenticate with Google Cloud using OIDC
     steps:
       - uses: actions/checkout@v4
 
       - uses: google-github-actions/auth@v2
         with:
           service_account: ${{ secrets.GCP_SA_EMAIL }}
-          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER}}
+          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
       - name: Set up Cloud SDK
         uses: google-github-actions/setup-gcloud@v2
       - name: Configure docker
@@ -122,13 +131,16 @@ jobs:
     name: Deploy worker to test env
     runs-on: ubuntu-latest
     if: github.event.repository.full_name == 'reearth/reearth-cms' && github.event.workflow_run.name == 'worker-build' && github.event.workflow_run.conclusion != 'failure' && github.event.workflow_run.head_branch == 'main'
+    permissions:
+      contents: read # To checkout
+      id-token: write # To authenticate with Google Cloud using OIDC
     steps:
       - uses: actions/checkout@v4
 
       - uses: google-github-actions/auth@v2
         with:
           service_account: ${{ secrets.GCP_SA_EMAIL }}
-          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER}}
+          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
       - name: Set up Cloud SDK
         uses: google-github-actions/setup-gcloud@v2
       - name: Configure docker