build/bake: support GCP WIF registry identities

crazy-max · crazy-max · commit 0200bc8567a4 · 2026-07-23T16:29:19.000+02:00
Signed-off-by: CrazyMax &lt;1951866+crazy-max@users.noreply.github.com&gt;
diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml
@@ -999,6 +999,27 @@ jobs:
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry-auth: ${{ needs.registry-identities.outputs.aws-ecr-registry-auth }}
+      -
+        name: Authenticate to Google Cloud
+        id: gcp-wif-auth
+        if: ${{ needs.registry-identities.outputs.gcp-wif-enabled == 'true' }}
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+        with:
+          token_format: access_token
+          workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }}
+          service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }}
+          project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }}
+          create_credentials_file: false
+          export_environment_variables: false
+      -
+        name: Login to Google Artifact Registry
+        if: ${{ needs.registry-identities.outputs.gcp-wif-enabled == 'true' }}
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry-auth: |
+            - registry: ${{ needs.registry-identities.outputs.gcp-wif-registry }}
+              username: oauth2accesstoken
+              password: ${{ steps.gcp-wif-auth.outputs.access_token }}
       -
         name: Login to registry
         if: ${{ inputs.push && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
@@ -1219,6 +1240,27 @@ jobs:
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry-auth: ${{ needs.registry-identities.outputs.aws-ecr-registry-auth }}
+      -
+        name: Authenticate to Google Cloud
+        id: gcp-wif-auth
+        if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.gcp-wif-enabled == 'true' }}
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+        with:
+          token_format: access_token
+          workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }}
+          service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }}
+          project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }}
+          create_credentials_file: false
+          export_environment_variables: false
+      -
+        name: Login to Google Artifact Registry
+        if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.gcp-wif-enabled == 'true' }}
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry-auth: |
+            - registry: ${{ needs.registry-identities.outputs.gcp-wif-registry }}
+              username: oauth2accesstoken
+              password: ${{ steps.gcp-wif-auth.outputs.access_token }}
       -
         name: Login to registry
         if: ${{ inputs.push && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -865,6 +865,27 @@ jobs:
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry-auth: ${{ needs.registry-identities.outputs.aws-ecr-registry-auth }}
+      -
+        name: Authenticate to Google Cloud
+        id: gcp-wif-auth
+        if: ${{ needs.registry-identities.outputs.gcp-wif-enabled == 'true' }}
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+        with:
+          token_format: access_token
+          workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }}
+          service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }}
+          project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }}
+          create_credentials_file: false
+          export_environment_variables: false
+      -
+        name: Login to Google Artifact Registry
+        if: ${{ needs.registry-identities.outputs.gcp-wif-enabled == 'true' }}
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry-auth: |
+            - registry: ${{ needs.registry-identities.outputs.gcp-wif-registry }}
+              username: oauth2accesstoken
+              password: ${{ steps.gcp-wif-auth.outputs.access_token }}
       -
         name: Login to registry
         if: ${{ inputs.push && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
@@ -1081,6 +1102,27 @@ jobs:
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry-auth: ${{ needs.registry-identities.outputs.aws-ecr-registry-auth }}
+      -
+        name: Authenticate to Google Cloud
+        id: gcp-wif-auth
+        if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.gcp-wif-enabled == 'true' }}
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+        with:
+          token_format: access_token
+          workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }}
+          service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }}
+          project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }}
+          create_credentials_file: false
+          export_environment_variables: false
+      -
+        name: Login to Google Artifact Registry
+        if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.gcp-wif-enabled == 'true' }}
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry-auth: |
+            - registry: ${{ needs.registry-identities.outputs.gcp-wif-registry }}
+              username: oauth2accesstoken
+              password: ${{ steps.gcp-wif-auth.outputs.access_token }}
       -
         name: Login to registry
         if: ${{ inputs.push && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
diff --git a/.github/workflows/setup-registry-identities.yml b/.github/workflows/setup-registry-identities.yml
@@ -20,6 +20,21 @@ on:
       aws-ecr-registry-auth:
         description: "Registry auth YAML for Docker login"
         value: ${{ jobs.setup-registry-identities.outputs.aws-ecr-registry-auth }}
+      gcp-wif-enabled:
+        description: "Whether a GCP Workload Identity Federation registry identity was configured"
+        value: ${{ jobs.setup-registry-identities.outputs.gcp-wif-enabled }}
+      gcp-wif-registry:
+        description: "Google Artifact Registry host to authenticate against"
+        value: ${{ jobs.setup-registry-identities.outputs.gcp-wif-registry }}
+      gcp-wif-workload-identity-provider:
+        description: "GCP Workload Identity Provider resource name"
+        value: ${{ jobs.setup-registry-identities.outputs.gcp-wif-workload-identity-provider }}
+      gcp-wif-service-account:
+        description: "GCP service account to impersonate"
+        value: ${{ jobs.setup-registry-identities.outputs.gcp-wif-service-account }}
+      gcp-wif-project-id:
+        description: "GCP project ID"
+        value: ${{ jobs.setup-registry-identities.outputs.gcp-wif-project-id }}
 
 env:
   RUNTIME_MODULE: "@docker/github-builder-runtime@0.92.0"
@@ -42,6 +57,11 @@ jobs:
       aws-ecr-role-to-assume: ${{ steps.validate.outputs.aws-ecr-role-to-assume }}
       aws-ecr-region: ${{ steps.validate.outputs.aws-ecr-region }}
       aws-ecr-registry-auth: ${{ steps.validate.outputs.aws-ecr-registry-auth }}
+      gcp-wif-enabled: ${{ steps.validate.outputs.gcp-wif-enabled }}
+      gcp-wif-registry: ${{ steps.validate.outputs.gcp-wif-registry }}
+      gcp-wif-workload-identity-provider: ${{ steps.validate.outputs.gcp-wif-workload-identity-provider }}
+      gcp-wif-service-account: ${{ steps.validate.outputs.gcp-wif-service-account }}
+      gcp-wif-project-id: ${{ steps.validate.outputs.gcp-wif-project-id }}
     steps:
       -
         name: Install dependencies
@@ -86,6 +106,11 @@ jobs:
               core.setOutput('aws-ecr-role-to-assume', '');
               core.setOutput('aws-ecr-region', '');
               core.setOutput('aws-ecr-registry-auth', '');
+              core.setOutput('gcp-wif-enabled', 'false');
+              core.setOutput('gcp-wif-registry', '');
+              core.setOutput('gcp-wif-workload-identity-provider', '');
+              core.setOutput('gcp-wif-service-account', '');
+              core.setOutput('gcp-wif-project-id', '');
             };
 
             const registryIdentities = core.getInput('registry-identities', {trimWhitespace: false});
@@ -135,6 +160,7 @@ jobs:
             }
 
             let awsEcr;
+            let gcpWif;
             entries.forEach((entry, index) => {
               const path = `registry-identities[${index}]`;
               ensureObject(entry, path);
@@ -162,6 +188,24 @@ jobs:
                   };
                   break;
                 }
+                case 'gcp-wif': {
+                  const allowedKeys = new Set(['type', 'registry', 'workload_identity_provider', 'service_account', 'project_id']);
+                  for (const key of Object.keys(entry)) {
+                    if (!allowedKeys.has(key)) {
+                      fail(`${path}.${key} is not supported for gcp-wif`);
+                    }
+                  }
+                  if (gcpWif) {
+                    fail('only one gcp-wif registry identity is supported');
+                  }
+                  gcpWif = {
+                    registry: requireString(entry, 'registry', path),
+                    workloadIdentityProvider: requireString(entry, 'workload_identity_provider', path),
+                    serviceAccount: requireString(entry, 'service_account', path),
+                    projectId: requireString(entry, 'project_id', path)
+                  };
+                  break;
+                }
                 default:
                   fail(`${path}.type has unsupported provider ${type}`);
               }
@@ -171,3 +215,8 @@ jobs:
             core.setOutput('aws-ecr-role-to-assume', awsEcr?.roleToAssume || '');
             core.setOutput('aws-ecr-region', awsEcr?.awsRegion || '');
             core.setOutput('aws-ecr-registry-auth', awsEcr?.registryAuth || '');
+            core.setOutput('gcp-wif-enabled', gcpWif ? 'true' : 'false');
+            core.setOutput('gcp-wif-registry', gcpWif?.registry || '');
+            core.setOutput('gcp-wif-workload-identity-provider', gcpWif?.workloadIdentityProvider || '');
+            core.setOutput('gcp-wif-service-account', gcpWif?.serviceAccount || '');
+            core.setOutput('gcp-wif-project-id', gcpWif?.projectId || '');
diff --git a/README.md b/README.md
@@ -19,6 +19,8 @@ ___
 * [Notes](#notes)
   * [Signed GitHub Actions cache](#signed-github-actions-cache)
   * [Registry identities](#registry-identities)
+    * [AWS ECR](#aws-ecr)
+    * [Google Artifact Registry](#google-artifact-registry)
   * [Runner mapping](#runner-mapping)
   * [Metadata templates](#metadata-templates)
 
@@ -412,9 +414,11 @@ secret. Provider-specific authentication steps are pinned in these reusable
 workflows; callers can only select supported provider types and pass identity
 configuration.
 
-Amazon ECR private registry authentication is configured with `type: aws-ecr`.
-Callers must grant `id-token: write` so the AWS credential step can assume the
-role through GitHub OIDC:
+#### AWS ECR
+
+Amazon ECR registry authentication is configured with `type: aws-ecr`. Callers
+must grant `id-token: write` so the AWS credential step can assume the role
+through GitHub OIDC:
 
 ```yaml
 jobs:
@@ -439,6 +443,38 @@ The `registry` value is required for AWS ECR. Use the registry server that
 `docker/login-action` should log in to, such as `public.ecr.aws` for public ECR
 or `123456789100.dkr.ecr.us-east-1.amazonaws.com` for private ECR.
 
+#### Google Artifact Registry
+
+Google Artifact Registry authentication is configured with `type: gcp-wif`.
+Callers must grant `id-token: write` so `google-github-actions/auth` can
+exchange the GitHub OIDC token through GCP Workload Identity Federation:
+
+```yaml
+jobs:
+  build:
+    uses: docker/github-builder/.github/workflows/build.yml@v1
+    permissions:
+      contents: read # to fetch the repository content
+      id-token: write # for signing attestations, cache entries with GitHub OIDC and log in to Google Artifact Registry
+    with:
+      output: image
+      push: ${{ github.event_name != 'pull_request' }}
+      meta-images: |
+        us-docker.pkg.dev/my-project/sandbox/test-github-builder
+      registry-identities: |
+        - type: gcp-wif
+          registry: us-docker.pkg.dev
+          workload_identity_provider: projects/123456789/locations/global/workloadIdentityPools/github/providers/provider
+          service_account: builder@my-project.iam.gserviceaccount.com
+          project_id: my-project
+```
+
+The `registry` value is required for GCP WIF. Use the Artifact Registry host
+that `docker/login-action` should log in to, such as `us-docker.pkg.dev`, not
+the full repository path. The workflow requests an access token from
+`google-github-actions/auth` and passes it directly to `docker/login-action`
+with the `oauth2accesstoken` username inside the same job.
+
 ### Runner mapping
 
 The `runner` input accepts either a single GitHub-hosted Linux runner label or a
