wlif-test.yaml

name: GitHub Actions
on: [push]
jobs:
  Job-One:
    runs-on: self-hosted
    permissions:
      id-token: write
    steps:
      - uses: 'actions/checkout@v3'

      # Configure Workload Identity Federation and generate an access token.
      - id: 'auth'
        name: 'Authenticate to Google Cloud'
        uses: 'google-github-actions/auth@v1'
        with:
          token_format: 'access_token'
          workload_identity_provider: '${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}'
          service_account: '${{ secrets.GCP_SA_NAME }}'
          audience: '${{ secrets.GCP_POOL_AUDIENCE }}'
          access_token_lifetime: '3600s' # optional, default: '3600s' (1 hour)

      - name: 'Access secret'
        run: |-
          curl https://secretmanager.googleapis.com/v1/projects/${{ secrets.GCP_PROJECT_ID }}/secrets/my-secret/versions/1:access \
            --header "Authorization: Bearer ${{ steps.auth.outputs.access_token }}"
          echo "Done!!!"