diff --git a/README.md b/README.md index a3064481..b38744e4 100644 --- a/README.md +++ b/README.md @@ -160,6 +160,10 @@ go to the [Gemini Assistant workflow documentation](./examples/workflows/gemini- - gcp_workload_identity_provider: _(Optional)_ The Google Cloud Workload Identity Provider. +- gcp_token_format: _(Optional, default: `access_token`)_ The token format for authentication. Set to "access_token" to generate access tokens (requires service account), or set to empty string for direct WIF. Can be "access_token" or "id_token". + +- gcp_access_token_scopes: _(Optional, default: `https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/userinfo.profile`)_ The access token scopes when using token_format "access_token". Comma-separated list of OAuth 2.0 scopes. + - gemini_api_key: _(Optional)_ The API key for the Gemini API. - gemini_cli_version: _(Optional, default: `latest`)_ The version of the Gemini CLI to install. Can be "latest", "preview", "nightly", a specific version number, or a git branch, tag, or commit. For more information, see [Gemini CLI releases](https://github.com/google-gemini/gemini-cli/blob/main/docs/releases.md). @@ -209,7 +213,7 @@ We recommend setting the following values as repository variables so they can be | `GEMINI_CLI_VERSION` | Controls which version of the Gemini CLI is installed. | Variable | No | Pinning the CLI version | | `GCP_WIF_PROVIDER` | Full resource name of the Workload Identity Provider. | Variable | No | Using Google Cloud | | `GOOGLE_CLOUD_PROJECT` | Google Cloud project for inference and observability. | Variable | No | Using Google Cloud | -| `SERVICE_ACCOUNT_EMAIL` | Google Cloud service account email address. | Variable | No | Using Google Cloud | +| `SERVICE_ACCOUNT_EMAIL` | Google Cloud service account email address. Optional - only needed for WIF with service account (not required for direct WIF). | Variable | No | Using WIF with service account | | `GOOGLE_CLOUD_LOCATION` | Region of the Google Cloud project. | Variable | No | Using Google Cloud | | `GOOGLE_GENAI_USE_VERTEXAI` | Set to `true` to use Vertex AI | Variable | No | Using Vertex AI | | `GOOGLE_GENAI_USE_GCA` | Set to `true` to use Gemini Code Assist | Variable | No | Using Gemini Code Assist | diff --git a/action.yml b/action.yml index 8fdaca62..1f87b96e 100644 --- a/action.yml +++ b/action.yml @@ -30,6 +30,14 @@ inputs: gcp_workload_identity_provider: description: 'The Google Cloud Workload Identity Provider.' required: false + gcp_token_format: + description: 'The token format for authentication. Set to "access_token" to generate access tokens (requires service account), or set to empty string for direct WIF. Can be "access_token" or "id_token".' + required: false + default: 'access_token' + gcp_access_token_scopes: + description: 'The access token scopes when using token_format "access_token". Comma-separated list of OAuth 2.0 scopes.' + required: false + default: 'https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/userinfo.profile' gemini_api_key: description: 'The API key for the Gemini API.' required: false @@ -123,8 +131,13 @@ runs: # Validate Workload Identity Federation inputs if [[ "${INPUT_GCP_WORKLOAD_IDENTITY_PROVIDER_PRESENT:-false}" == "true" ]]; then - if [[ "${INPUT_GCP_PROJECT_ID_PRESENT:-false}" != "true" || "${INPUT_GCP_SERVICE_ACCOUNT_PRESENT:-false}" != "true" ]]; then - warn "When using Workload Identity Federation ('gcp_workload_identity_provider'), you must also provide 'gcp_project_id' and 'gcp_service_account'." + if [[ "${INPUT_GCP_PROJECT_ID_PRESENT:-false}" != "true" ]]; then + warn "When using Workload Identity Federation ('gcp_workload_identity_provider'), you must also provide 'gcp_project_id'." + fi + # Service account is required when using token_format (default behavior) + # Only optional when explicitly set to empty for direct WIF + if [[ "${INPUT_GCP_TOKEN_FORMAT}" != "" && "${INPUT_GCP_SERVICE_ACCOUNT_PRESENT:-false}" != "true" ]]; then + warn "When using Workload Identity Federation with token generation ('gcp_token_format'), you must also provide 'gcp_service_account'. To use direct WIF without a service account, explicitly set 'gcp_token_format' to an empty string." fi if [[ "${INPUT_USE_VERTEX_AI:-false}" == "${INPUT_USE_GEMINI_CODE_ASSIST:-false}" ]]; then warn "When using Workload Identity Federation, you must set exactly one of 'use_vertex_ai' or 'use_gemini_code_assist' to 'true'." @@ -153,6 +166,7 @@ runs: INPUT_GCP_WORKLOAD_IDENTITY_PROVIDER_PRESENT: "${{ inputs.gcp_workload_identity_provider != '' }}" INPUT_GCP_PROJECT_ID_PRESENT: "${{ inputs.gcp_project_id != '' }}" INPUT_GCP_SERVICE_ACCOUNT_PRESENT: "${{ inputs.gcp_service_account != '' }}" + INPUT_GCP_TOKEN_FORMAT: '${{ inputs.gcp_token_format }}' INPUT_USE_VERTEX_AI: '${{ inputs.use_vertex_ai }}' INPUT_USE_GEMINI_CODE_ASSIST: '${{ inputs.use_gemini_code_assist }}' @@ -184,8 +198,8 @@ runs: project_id: '${{ inputs.gcp_project_id }}' workload_identity_provider: '${{ inputs.gcp_workload_identity_provider }}' service_account: '${{ inputs.gcp_service_account }}' - token_format: 'access_token' - access_token_scopes: 'https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/userinfo.profile' + token_format: '${{ inputs.gcp_token_format }}' + access_token_scopes: '${{ inputs.gcp_access_token_scopes }}' - name: 'Install Gemini CLI' id: 'install' diff --git a/docs/authentication.md b/docs/authentication.md index d1284423..0ed6b597 100644 --- a/docs/authentication.md +++ b/docs/authentication.md @@ -196,6 +196,9 @@ After running the `setup_workload_identity.sh` script, add the following variabl Explain this code ``` +> [!NOTE] +> You can use direct Workload Identity Federation without a service account by setting `gcp_token_format: ''` and omitting `gcp_service_account`. + #### Connecting to Gemini Code Assist If you have a **Gemini Code Assist** subscription, you can configure the action to use it for authentication. @@ -230,6 +233,9 @@ After running the `setup_workload_identity.sh` script, add the following variabl Explain this code ``` +> [!NOTE] +> You can use direct Workload Identity Federation without a service account by setting `gcp_token_format: ''` and omitting `gcp_service_account`. + ## GitHub Authentication This action requires a GitHub token to interact with the GitHub API. You can authenticate in two ways: