Skip to content

fix(ci): match the immutable GitHub OIDC subject #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
souravC01 merged 1 commit into from
Sep 12, 2026
Merged

fix(ci): match the immutable GitHub OIDC subject #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion docs/cloud-run-cicd.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,11 @@ GitHub OIDC tokens matching repository ID `1355476075`, owner ID `114119117`,
repository `souravC01/JobHelperGuru`, branch `refs/heads/main`, event `push`, and
workflow `souravC01/JobHelperGuru/.github/workflows/ci.yml@refs/heads/main`.
The deployer impersonation binding additionally requires the exact main-branch
OIDC subject. Pull requests, forks, other branches, manual dispatches, and other
OIDC subject `repo:souravC01@114119117/JobHelperGuru@1355476075:ref:refs/heads/main`.
This repository uses GitHub's immutable subject format. Check
`gh api repos/souravC01/JobHelperGuru/actions/oidc/customization/sub` before
recreating federation; a name-only subject will be rejected even when all other
claims match. Pull requests, forks, other branches, manual dispatches, and other
workflow files cannot use this provider. No service-account JSON keys or new
GitHub secrets are needed. The provider identifier and account email in the
workflow are public configuration.
Expand Down
5 changes: 3 additions & 2 deletions scripts/setup-cloud-run-cicd.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ pool=jobhelperguru-github
provider=github-main
deployer=jobhelperguru-github-deployer@jobhelperguru.iam.gserviceaccount.com
runtime=jobhelperguru-runner@jobhelperguru.iam.gserviceaccount.com
subject='repo:souravC01@114119117/JobHelperGuru@1355476075:ref:refs/heads/main'

actual_number=$(gcloud projects describe "$project" --format='value(projectNumber)')
[[ "$actual_number" == "$project_number" ]] || { echo 'Unexpected project number'; exit 1; }
Expand All @@ -28,7 +29,7 @@ gcloud iam workload-identity-pools create "$pool" \

# Numeric IDs prevent a renamed or recreated repository or owner from inheriting
# access. Also require the exact repository, branch, event, and workflow file.
condition="assertion.repository_id == '1355476075' && assertion.repository_owner_id == '114119117' && assertion.repository == 'souravC01/JobHelperGuru' && assertion.ref == 'refs/heads/main' && assertion.event_name == 'push' && assertion.workflow_ref == 'souravC01/JobHelperGuru/.github/workflows/ci.yml@refs/heads/main' && assertion.sub == 'repo:souravC01/JobHelperGuru:ref:refs/heads/main'"
condition="assertion.repository_id == '1355476075' && assertion.repository_owner_id == '114119117' && assertion.repository == 'souravC01/JobHelperGuru' && assertion.ref == 'refs/heads/main' && assertion.event_name == 'push' && assertion.workflow_ref == 'souravC01/JobHelperGuru/.github/workflows/ci.yml@refs/heads/main' && assertion.sub == '$subject'"
gcloud iam workload-identity-pools providers create-oidc "$provider" \
--project="$project" --location=global --workload-identity-pool="$pool" \
--display-name='GitHub main CI workflow' \
Expand All @@ -38,7 +39,7 @@ gcloud iam workload-identity-pools providers create-oidc "$provider" \

gcloud iam service-accounts add-iam-policy-binding "$deployer" \
--project="$project" --role=roles/iam.workloadIdentityUser \
--member="principal://iam.googleapis.com/projects/$project_number/locations/global/workloadIdentityPools/$pool/subject/repo:souravC01/JobHelperGuru:ref:refs/heads/main" \
--member="principal://iam.googleapis.com/projects/$project_number/locations/global/workloadIdentityPools/$pool/subject/$subject" \
--condition=None
gcloud artifacts repositories add-iam-policy-binding jobhelperguru \
--project="$project" --location="$region" \
Expand Down
Loading