GitHub Actions + GCP CI/CD 完全ガイド｜Workload Identity・Cloud Run/GKE デプロイ

GitHub Actions と GCP の連携は、Workload Identity Federation (WIF) でキーレス認証が標準化されました。 本記事では WIF セットアップから、Cloud Run / GKE / BigQuery デプロイ、Reusable Workflow、Cloud Build 連携まで実装例を網羅します。

Workload Identity Federation セットアップ

# 1. Workload Identity Pool 作成
gcloud iam workload-identity-pools create github \
  --location=global --display-name="GitHub Actions"

# 2. OIDC Provider 設定
gcloud iam workload-identity-pools providers create-oidc github-provider \
  --location=global --workload-identity-pool=github \
  --issuer-uri="https://token.actions.githubusercontent.com" \
  --attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository" \
  --attribute-condition="assertion.repository_owner == 'YOUR_ORG'"

# 3. Service Account 作成
gcloud iam service-accounts create github-actions \
  --display-name="GitHub Actions SA"

# 4. SA に必要な Role 付与
gcloud projects add-iam-policy-binding PROJECT \
  --member="serviceAccount:[email protected]" \
  --role="roles/run.admin"

# 5. WIF Pool ↔ SA 紐づけ
gcloud iam service-accounts add-iam-policy-binding \
  [email protected] \
  --role=roles/iam.workloadIdentityUser \
  --member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github/attribute.repository/YOUR_ORG/YOUR_REPO"

基本 Workflow (Cloud Run デプロイ)

# .github/workflows/deploy.yml
name: Deploy to Cloud Run

on:
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write   # WIF に必須

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github/providers/github-provider
          service_account: [email protected]

      - uses: google-github-actions/setup-gcloud@v2

      - name: Configure Docker
        run: gcloud auth configure-docker asia-northeast1-docker.pkg.dev

      - name: Build & Push
        run: |
          IMAGE=asia-northeast1-docker.pkg.dev/PROJECT/repo/app:${{ github.sha }}
          docker build -t $IMAGE .
          docker push $IMAGE

      - name: Deploy
        run: |
          gcloud run deploy my-app \
            --image=asia-northeast1-docker.pkg.dev/PROJECT/repo/app:${{ github.sha }} \
            --region=asia-northeast1 \
            --allow-unauthenticated

GKE デプロイ Workflow

- uses: google-github-actions/get-gke-credentials@v2
  with:
    cluster_name: my-cluster
    location: asia-northeast1

- name: Helm Deploy
  run: |
    helm upgrade --install my-app ./chart \
      --set image.tag=${{ github.sha }} \
      --namespace=production

Reusable Workflow パターン

# .github/workflows/reusable-deploy.yml
on:
  workflow_call:
    inputs:
      service:    { required: true, type: string }
      region:     { default: 'asia-northeast1', type: string }
      image_tag:  { required: true, type: string }

permissions: { id-token: write, contents: read }

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ...
          service_account: ...
      - run: gcloud run deploy ${{ inputs.service }} --image=... --region=${{ inputs.region }}

# 利用側
jobs:
  deploy-api:
    uses: ./.github/workflows/reusable-deploy.yml
    with:
      service:   api
      image_tag: ${{ github.sha }}

Secret Manager 統合

- id: secrets
  uses: google-github-actions/get-secretmanager-secrets@v2
  with:
    secrets: |
      DB_PASSWORD:PROJECT/db-password
      API_KEY:PROJECT/api-key

- run: ./deploy.sh
  env:
    DB_PASSWORD: ${{ steps.secrets.outputs.DB_PASSWORD }}
    API_KEY:     ${{ steps.secrets.outputs.API_KEY }}

Cloud Build トリガー連携

- name: Trigger Cloud Build
  run: |
    gcloud builds submit --config=cloudbuild.yaml \
      --substitutions=_BRANCH=${{ github.ref_name }},_SHA=${{ github.sha }}

Self-hosted Runner (VPC 内)

• GCE VM に GitHub Runner インストール (Private IP)
• VPC 内リソース (CloudSQL Private IP / IAP / オンプレ DB) アクセス可
• Larger Runners + Private Networking (2024 GA) で GitHub マネージドのまま VPC 接続も可
• セキュリティ: 1 ジョブごとに VM 破棄 (Ephemeral)

典型的なフロー

1. PR push → Actions で lint / test / build
2. main merge → Cloud Build 起動 (Container 署名)
3. Artifact Registry に push (Binary Authorization 適用)
4. Cloud Deploy に Release 作成
5. Dev → Staging → Prod の Canary プロモート
6. Cloud Monitoring で SLO 違反時に自動ロールバック

ベストプラクティス

• SA キーはリポジトリに置かない (WIF 一択)
• Environment ごとに承認ゲート (production 環境)
• Reusable Workflow で標準化
• Concurrency 設定で同時実行制御
• OIDC token 利用範囲を最小化 (Attribute Condition)
• SLSA Level 3 でビルド来歴記録

※ Google Cloud は Google LLC、GitHub は GitHub, Inc. の登録商標です。最新は google-github-actions 公式 をご確認ください。