源文件
gcp/wif/github-pool.yaml

离线配置。未部署到任何云账号。
# GitHub Actions to GCP Workload Identity Federation. Project number is a placeholder.
workloadIdentityPool:
  project: thistle-analytics-demo
  projectNumber: "000000000000"
  poolId: github-pool
  location: global
  displayName: GitHub
provider:
  providerId: github-provider
  issuer: https://token.actions.githubusercontent.com
  attributeCondition: assertion.sub == 'repo:example.invalid/thistle-analytics/insights-api' && assertion.repository == 'example.invalid/thistle-analytics/insights-api'
  attributeMapping:
    google.subject: assertion.sub
    attribute.repository: assertion.repository
serviceAccount: github-deploy-sa@thistle-analytics-demo.iam.gserviceaccount.com
principal: principalSet://iam.googleapis.com/projects/000000000000/locations/global/workloadIdentityPools/github-pool/attribute.repository/example.invalid/thistle-analytics/insights-api
workloadIdentityProvider: projects/000000000000/locations/global/workloadIdentityPools/github-pool/providers/github-provider
note: No JSON key is stored. GitHub requests an ID token and exchanges it through this pool.