ci: migrate GCP auth to keyless Workload Identity Federation (WIF)

[tsavo-at-pieces]

Summary

The static GCP_CREDENTIALS service-account key (SA github-actions@integration-server-326115, project integration-server-326115 / #497784144587) was deleted during weekend incident remediation, which broke the GCS upload in the release/staging pipeline (push-build job). This PR migrates CI to keyless Workload Identity Federation (OIDC) so no static key is needed, mirroring the builds_server #19/#20 pattern.

Changes

• build.yaml (push-build job):
  • google-github-actions/auth@v2 + credentials_json ➜ auth@v3 keyless WIF (workload_identity_provider + service_account, create_credentials_file: true).
  • setup-gcloud@v2 now pins project_id: integration-server-326115 (replacing the dropped, undeclared inputs.project_id).
  • Added job permissions: { id-token: write, contents: write } (id-token for OIDC, contents for softprops/action-gh-release).
• release.yaml / staging.yaml (callers of the reusable workflow):
  • Granted permissions: { id-token: write, contents: write } on the calling job so the reusable workflow can mint the OIDC token.
  • Removed the now-unused secrets.credentials_json: ${{ secrets.GCP_CREDENTIALS }} passthrough.
• build.yaml (workflow_call): declared the previously-undeclared beta input (type: boolean, default false); removed the credentials_json secret declaration.

GCP infra (verified, not modified)

• WIF binding for pieces-app/plugin_sublime ➜ roles/iam.workloadIdentityUser on github-actions@integration-server-326115 is already present (verified via get-iam-policy, not recreated).
• Provider: projects/497784144587/locations/global/workloadIdentityPools/github-pool/providers/github-provider.
• Buckets app-releases-production / app-releases-staging are in the standard allowlist (app-releases-*) — no additional bucket-scoped grant required.
• No chained impersonation; gsutil-only (no gcloud run deploy) ➜ no runtime SA required. No IAM writes performed.

Test plan

• Do not merge until a manual validation run is green.
• Push to main triggers Staging ➜ confirm push-build authenticates via WIF and gsutil cp to gs://app-releases-staging/... succeeds.
• Tag push (*.*.*) triggers Release ➜ confirm WIF auth + gsutil cp to gs://app-releases-production/... and GitHub Release creation succeed.

Notes / follow-ups

• The GCP_CREDENTIALS GitHub secret is left in place (now unused); safe to delete after validation.
• Latent (pre-existing, out of scope): secrets.PERSONAL_ACCESS_TOKEN in the build job is referenced but not declared in workflow_call.secrets nor inherited, so it resolves empty on the version-mismatch error path.

Made with Cursor

[Copilot]

Pull request overview

Migrates the CI release/staging pipeline from a deleted static GCP service-account key (GCP_CREDENTIALS) to keyless Google Cloud authentication via GitHub OIDC + Workload Identity Federation (WIF), so the push-build job can upload artifacts to GCS and create GitHub Releases without storing long-lived credentials.

Changes:

• Updated the reusable build workflow to use google-github-actions/auth@v3 with WIF (workload_identity_provider + service_account) and pinned project_id for setup-gcloud.
• Granted id-token: write / contents: write permissions where needed (caller jobs and the push-build job) to enable OIDC minting and GitHub Release creation.
• Removed the credentials_json secret passthrough/declaration and declared the previously-undeclared beta workflow input.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/build.yaml	Switches GCP auth to keyless WIF, pins project_id, adds required job permissions, and updates workflow-call interface (inputs/secrets).
.github/workflows/staging.yaml	Adds caller job permissions and removes the unused GCP_CREDENTIALS secret passthrough.
.github/workflows/release.yaml	Adds caller job permissions and removes the unused GCP_CREDENTIALS secret passthrough.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.