源文件
gcp/iam/github-deploy-sa.yaml

离线配置。未部署到任何云账号。
sa: github-deploy-sa
email: github-deploy-sa@thistle-analytics-demo.iam.gserviceaccount.com
purpose: deploy
description: GitHub Actions identity via Workload Identity Federation. Same deploy scope as Cloud Build.
bindings:
  - member: serviceAccount:github-deploy-sa@thistle-analytics-demo.iam.gserviceaccount.com
    role: roles/run.admin
    resource: projects/thistle-analytics-demo/locations/asia-east1/services/insights-api
    purpose: deploy
    sa: github-deploy-sa
  - member: serviceAccount:github-deploy-sa@thistle-analytics-demo.iam.gserviceaccount.com
    role: roles/artifactregistry.writer
    resource: projects/thistle-analytics-demo/locations/asia-east1/repositories/apps
    purpose: deploy
    sa: github-deploy-sa
  - member: serviceAccount:github-deploy-sa@thistle-analytics-demo.iam.gserviceaccount.com
    role: roles/iam.serviceAccountUser
    resource: projects/thistle-analytics-demo/serviceAccounts/insights-api-sa@thistle-analytics-demo.iam.gserviceaccount.com
    purpose: deploy
    sa: github-deploy-sa
  - member: principalSet://iam.googleapis.com/projects/000000000000/locations/global/workloadIdentityPools/github-pool/attribute.repository/example.invalid/thistle-analytics/insights-api
    role: roles/iam.workloadIdentityUser
    resource: projects/thistle-analytics-demo/serviceAccounts/github-deploy-sa@thistle-analytics-demo.iam.gserviceaccount.com
    purpose: wif
    sa: github-deploy-sa