github-gsa

github-gsa

This module creates a Google Service Account that can be assumed by particular GitHub Actions workflows. It is intended to be used in conjunction with the github-wif-provider module.

module "github-wif" {
  source = "chainguard-dev/common/infra//modules/github-wif-provider"

  project_id = var.project_id
  name       = "my-wif-pool"

  notification_channels = var.notification_channels
}

module "foo" {
  source = "chainguard-dev/common/infra//modules/github-gsa"

  project_id = var.project_id
  name       = "foo"
  wif-pool   = module.github-wif.pool_name

  repository   = "the-org/the-repo"
  refspec      = "refs/heads/main"
  workflow_ref = ".github/workflows/my-workflow.yaml"

  notification_channels = var.notification_channels
}

Requirements

No requirements.

Providers

Name	Version
google	n/a

Modules

No modules.

Resources

Name	Type
google_service_account.this	resource
google_service_account_iam_binding.allow-impersonation	resource

Inputs

Name	Description	Type	Default	Required
audit_refspec	The regular expression to use for auditing the refspec component when using '*'	string	""	no
audit_workflow_ref	The regular expression to use for auditing the workflow ref component when using '*'	string	""	no
name	The name to give the service account.	string	n/a	yes
notification_channels	The list of notification channels to alert when the service account is misused.	list(string)	n/a	yes
project_id	n/a	string	n/a	yes
refspec	The refspec to allow to federate with this identity.	string	n/a	yes
repository	The name of the repository to allow to assume this identity.	string	n/a	yes
wif-pool	The name of the Workload Identity Federation pool.	string	n/a	yes
workflow_ref	The workflow to allow to federate with this identity (e.g. .github/workflows/deploy.yaml).	string	n/a	yes

Outputs

Name	Description
email	n/a