Question

Your team deploys to Google Cloud from GitHub Actions using Workload Identity Federation to avoid storing a long-lived service-account key. The deploy job currently fails at the authentication step with an error indicating no OIDC token could be requested. Your workflow uses the official google-github-actions/auth action with the workload_identity_provider and service_account inputs correctly configured. Which change to the workflow is required to fix the authentication failure?

Accepted Answer

Add permissions: id-token: write (and contents: read) at the job or workflow level so the runner can mint the OIDC token.

Answer

Store the service-account JSON key as a repository secret and pass it via the credentials_json input instead.

Answer

Grant the GITHUB_TOKEN permissions: contents: write so it can exchange itself for a Google access token.

Answer

Pin the auth action to a full commit SHA, because floating tags block OIDC token issuance.