Use workload identity federation for GCP.
Section: OIDC and fork safety
Authenticate to Google Cloud with OIDC
yaml
yaml
- uses: google-github-actions/auth@v2
with:
workload_identity_provider: projects/123456789/locations/global/workloadIdentityPools/pool/providers/provider
service_account: deployer@example-project.iam.gserviceaccount.comExplanation
This avoids storing long-lived JSON keys in repository secrets.
Learn the surrounding workflow
Compare similar commands or jump into common fixes when this command is part of a bigger troubleshooting path.
Related commands
Same sheet · prioritizing OIDC and fork safety
Enable OIDC token issuance
Grant `id-token: write` when using cloud federation.
Configure AWS credentials via OIDC
Use the AWS credentials action without long-lived keys.
Do not expose secrets to untrusted forks
Avoid unsafe patterns for public repo pull requests.