Skip to content

Commit f8a07b9

Browse files
HassanJasimHassanJasim
committed
Addressing PR Comments
1 parent 9210827 commit f8a07b9

2 files changed

Lines changed: 36 additions & 33 deletions

File tree

‎README.md‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,8 @@ Set the following environment variables in your repository or workflow:
7979
| GEMINI_CLI_VERSION | Controls which version of the Gemini CLI is installed. Supports npm versions (e.g., `0.1.0`, `latest`), a branch name (e.g., `main`), or a commit hash. | Variable | No | To pin or override CLI version |
8080
| OTLP_GCP_WIF_PROVIDER | The full resource name of the Workload Identity Provider. | Variable | No | If using observability |
8181
| OTLP_GOOGLE_CLOUD_PROJECT | The Google Cloud project for telemetry. | Variable | No | If using observability |
82+
| GOOGLE_CLOUD_PROJECT | The Google Cloud project for Vertex auth. | Variable | No | If using Vertex auth |
83+
| GOOGLE_CLOUD_LOCATION | The location of the Google Cloud project for Vertex auth. | Variable | No | If using Vertex auth |
8284
| APP_ID | GitHub App ID for custom authentication. | Variable | No | If using a custom GitHub App |
8385

8486

@@ -91,10 +93,10 @@ save. For organization-wide or environment-specific variables, see the
9193

9294
The following secrets are required for security:
9395

94-
| Name | Description | Required | When Required |
95-
|-------------------|-----------------------------------------------|----------|------------------------------|
96-
| GEMINI_API_KEY | Your Gemini API key. | Yes | Always |
97-
| APP_PRIVATE_KEY | Private key for your GitHub App (PEM format). | No | If using a custom GitHub App |
96+
| Name | Description | Required | When Required |
97+
|-------------------|-----------------------------------------------|----------|----------------------------------------|
98+
| GEMINI_API_KEY | Your Gemini API key. | No | If you don't intend to use vertex auth |
99+
| APP_PRIVATE_KEY | Private key for your GitHub App (PEM format). | No | If using a custom GitHub App |
98100

99101
To add a secret, go to your repository's **Settings > Secrets and variables >
100102
Actions > New repository secret**. For more information, see the

‎scripts/setup_workload_identity.sh‎

Lines changed: 30 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,8 @@ print_header() {
5151
}
5252

5353
# Default values
54-
GCP_PROJECT_ID=""
54+
GOOGLE_CLOUD_PROJECT=""
55+
GOOGLE_CLOUD_LOCATION="global"
5556
GITHUB_REPO=""
5657
POOL_NAME="github"
5758

@@ -99,7 +100,7 @@ while [[ $# -gt 0 ]]; do
99100
shift 2
100101
;;
101102
-p|--project)
102-
GCP_PROJECT_ID="$2"
103+
GOOGLE_CLOUD_PROJECT="$2"
103104
shift 2
104105
;;
105106
--pool-name)
@@ -139,17 +140,17 @@ if [[ ! "${GITHUB_REPO}" =~ ^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+$ ]]; then
139140
fi
140141

141142
# Auto-detect project ID if not provided
142-
if [[ -z "${GCP_PROJECT_ID}" ]]; then
143+
if [[ -z "${GOOGLE_CLOUD_PROJECT}" ]]; then
143144
print_info "Auto-detecting Google Cloud project..."
144-
GCP_PROJECT_ID=$(gcloud config get-value project 2>/dev/null)
145-
if [[ -z "${GCP_PROJECT_ID}" ]]; then
145+
GOOGLE_CLOUD_PROJECT=$(gcloud config get-value project 2>/dev/null)
146+
if [[ -z "${GOOGLE_CLOUD_PROJECT}" ]]; then
146147
print_error "Could not auto-detect Google Cloud project ID"
147148
echo "Please either:"
148149
echo " 1. Set default project: gcloud config set project YOUR_PROJECT_ID"
149150
echo " 2. Use --project flag: $0 --repo ${GITHUB_REPO} --project YOUR_PROJECT_ID"
150151
exit 1
151152
fi
152-
print_success "Using project: ${GCP_PROJECT_ID}"
153+
print_success "Using project: ${GOOGLE_CLOUD_PROJECT}"
153154
fi
154155

155156
# Extract repository components
@@ -164,7 +165,7 @@ PROVIDER_NAME="gh-${REPO_HASH}"
164165

165166
print_header "Starting Direct Workload Identity Federation setup"
166167
echo "📦 Repository: ${GITHUB_REPO}"
167-
echo "☁️ Project: ${GCP_PROJECT_ID}"
168+
echo "☁️ Project: ${GOOGLE_CLOUD_PROJECT}"
168169
echo "🏊 Pool: ${POOL_NAME}"
169170
echo "🆔 Provider: ${PROVIDER_NAME}"
170171
echo ""
@@ -180,8 +181,8 @@ if [[ -z "${GCLOUD_AUTH_LIST}" ]]; then
180181
fi
181182

182183
# Test project access
183-
if ! gcloud projects describe "${GCP_PROJECT_ID}" > /dev/null 2>&1; then
184-
print_error "Cannot access project '${GCP_PROJECT_ID}'"
184+
if ! gcloud projects describe "${GOOGLE_CLOUD_PROJECT}" > /dev/null 2>&1; then
185+
print_error "Cannot access project '${GOOGLE_CLOUD_PROJECT}'"
185186
echo "Please verify:"
186187
echo " 1. Project ID is correct"
187188
echo " 2. You have permissions on this project"
@@ -196,18 +197,18 @@ print_header "Step 1: Enabling required Google Cloud APIs"
196197
apis_to_enable="iamcredentials.googleapis.com cloudresourcemanager.googleapis.com iam.googleapis.com sts.googleapis.com logging.googleapis.com monitoring.googleapis.com cloudtrace.googleapis.com"
197198

198199
print_info "Enabling APIs: ${apis_to_enable}"
199-
# gcloud services enable "${apis_to_enable}" --project="${GCP_PROJECT_ID}"
200+
gcloud services enable "${apis_to_enable}" --project="${GOOGLE_CLOUD_PROJECT}"
200201
print_success "APIs enabled successfully"
201202

202203
# Step 2: Create Workload Identity Pool
203204
print_header "Step 2: Creating Workload Identity Pool"
204205
if ! gcloud iam workload-identity-pools describe "${POOL_NAME}" \
205-
--project="${GCP_PROJECT_ID}" \
206-
--location="global" &> /dev/null; then
206+
--project="${GOOGLE_CLOUD_PROJECT}" \
207+
--location="${GOOGLE_CLOUD_LOCATION}" &> /dev/null; then
207208
print_info "Creating Workload Identity Pool: ${POOL_NAME}"
208209
gcloud iam workload-identity-pools create "${POOL_NAME}" \
209-
--project="${GCP_PROJECT_ID}" \
210-
--location="global" \
210+
--project="${GOOGLE_CLOUD_PROJECT}" \
211+
--location="${GOOGLE_CLOUD_LOCATION}" \
211212
--display-name="GitHub Actions Pool"
212213
print_success "Workload Identity Pool created"
213214
else
@@ -216,22 +217,22 @@ fi
216217

217218
# Get the pool ID
218219
WIF_POOL_ID=$(gcloud iam workload-identity-pools describe "${POOL_NAME}" \
219-
--project="${GCP_PROJECT_ID}" \
220-
--location="global" \
220+
--project="${GOOGLE_CLOUD_PROJECT}" \
221+
--location="${GOOGLE_CLOUD_LOCATION}" \
221222
--format="value(name)")
222223

223224
# Step 3: Create Workload Identity Provider
224225
print_header "Step 3: Creating Workload Identity Provider"
225226
ATTRIBUTE_CONDITION="assertion.repository_owner == '${REPO_OWNER}'"
226227

227228
if ! gcloud iam workload-identity-pools providers describe "${PROVIDER_NAME}" \
228-
--project="${GCP_PROJECT_ID}" \
229-
--location="global" \
229+
--project="${GOOGLE_CLOUD_PROJECT}" \
230+
--location="${GOOGLE_CLOUD_LOCATION}" \
230231
--workload-identity-pool="${POOL_NAME}" &> /dev/null; then
231232
print_info "Creating Workload Identity Provider: ${PROVIDER_NAME}"
232233
gcloud iam workload-identity-pools providers create-oidc "${PROVIDER_NAME}" \
233-
--project="${GCP_PROJECT_ID}" \
234-
--location="global" \
234+
--project="${GOOGLE_CLOUD_PROJECT}" \
235+
--location="${GOOGLE_CLOUD_LOCATION}" \
235236
--workload-identity-pool="${POOL_NAME}" \
236237
--display-name="${PROVIDER_NAME}" \
237238
--attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner" \
@@ -250,26 +251,26 @@ print_info "Granting standard CI/CD permissions directly to the Workload Identit
250251

251252
# Core observability permissions
252253
print_info "Granting logging permissions..."
253-
gcloud projects add-iam-policy-binding "${GCP_PROJECT_ID}" \
254+
gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
254255
--role="roles/logging.logWriter" \
255256
--member="${PRINCIPAL_SET}" \
256257
--condition=None
257258

258259
print_info "Granting monitoring permissions..."
259-
gcloud projects add-iam-policy-binding "${GCP_PROJECT_ID}" \
260+
gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
260261
--role="roles/monitoring.editor" \
261262
--member="${PRINCIPAL_SET}" \
262263
--condition=None
263264

264265
print_info "Granting tracing permissions..."
265-
gcloud projects add-iam-policy-binding "${GCP_PROJECT_ID}" \
266+
gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
266267
--role="roles/cloudtrace.agent" \
267268
--member="${PRINCIPAL_SET}" \
268269
--condition=None
269270

270271

271272
print_info "Granting vertex permissions..."
272-
gcloud projects add-iam-policy-binding "${GCP_PROJECT_ID}" \
273+
gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
273274
--role="roles/aiplatform.user" \
274275
--member="${PRINCIPAL_SET}" \
275276
--condition=None
@@ -278,8 +279,8 @@ print_success "Standard permissions granted to Workload Identity Pool"
278279

279280
# Get the full provider name for output
280281
WIF_PROVIDER_FULL=$(gcloud iam workload-identity-pools providers describe "${PROVIDER_NAME}" \
281-
--project="${GCP_PROJECT_ID}" \
282-
--location="global" \
282+
--project="${GOOGLE_CLOUD_PROJECT}" \
283+
--location="${GOOGLE_CLOUD_LOCATION}" \
283284
--workload-identity-pool="${POOL_NAME}" \
284285
--format="value(name)")
285286

@@ -306,13 +307,13 @@ echo "🔑 Variable Name: OTLP_GCP_WIF_PROVIDER"
306307
echo " Value: ${WIF_PROVIDER_FULL}"
307308
echo ""
308309
echo "☁️ Variable Name: OTLP_GOOGLE_CLOUD_PROJECT"
309-
echo " Value: ${GCP_PROJECT_ID}"
310+
echo " Value: ${GOOGLE_CLOUD_PROJECT}"
310311
echo ""
311312
echo "☁️ Secret Name: GOOGLE_CLOUD_LOCATION"
312-
echo " Secret Value: global"
313+
echo " Secret Value: ${GOOGLE_CLOUD_LOCATION}"
313314
echo ""
314315
echo "☁️ Secret Name: GOOGLE_CLOUD_PROJECT"
315-
echo " Secret Value: ${GCP_PROJECT_ID}"
316+
echo " Secret Value: ${GOOGLE_CLOUD_PROJECT}"
316317
echo ""
317318

318319
print_success "Setup completed successfully! 🚀"

0 commit comments

Comments
 (0)