GitHub Actions + GCP CI/CD Complete Guide: Workload Identity, Cloud Run/GKE Deploys

GitHub Actions ↔ GCP integration has standardized on keyless authentication via Workload Identity Federation (WIF). This article walks through implementation examples from WIF setup to Cloud Run / GKE / BigQuery deploys, Reusable Workflows, and Cloud Build integration.

Workload Identity Federation Setup

# 1. Create the Workload Identity Pool
gcloud iam workload-identity-pools create github \
  --location=global --display-name="GitHub Actions"

# 2. Configure the OIDC provider
gcloud iam workload-identity-pools providers create-oidc github-provider \
  --location=global --workload-identity-pool=github \
  --issuer-uri="https://token.actions.githubusercontent.com" \
  --attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository" \
  --attribute-condition="assertion.repository_owner == 'YOUR_ORG'"

# 3. Create the service account
gcloud iam service-accounts create github-actions \
  --display-name="GitHub Actions SA"

# 4. Grant the required roles to the SA
gcloud projects add-iam-policy-binding PROJECT \
  --member="serviceAccount:[email protected]" \
  --role="roles/run.admin"

# 5. Bind the WIF pool to the SA
gcloud iam service-accounts add-iam-policy-binding \
  [email protected] \
  --role=roles/iam.workloadIdentityUser \
  --member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github/attribute.repository/YOUR_ORG/YOUR_REPO"

Basic Workflow (Cloud Run Deploy)

# .github/workflows/deploy.yml
name: Deploy to Cloud Run

on:
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write   # required for WIF

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github/providers/github-provider
          service_account: [email protected]

      - uses: google-github-actions/setup-gcloud@v2

      - name: Configure Docker
        run: gcloud auth configure-docker asia-northeast1-docker.pkg.dev

      - name: Build & Push
        run: |
          IMAGE=asia-northeast1-docker.pkg.dev/PROJECT/repo/app:${{ github.sha }}
          docker build -t $IMAGE .
          docker push $IMAGE

      - name: Deploy
        run: |
          gcloud run deploy my-app \
            --image=asia-northeast1-docker.pkg.dev/PROJECT/repo/app:${{ github.sha }} \
            --region=asia-northeast1 \
            --allow-unauthenticated

GKE Deploy Workflow

- uses: google-github-actions/get-gke-credentials@v2
  with:
    cluster_name: my-cluster
    location: asia-northeast1

- name: Helm Deploy
  run: |
    helm upgrade --install my-app ./chart \
      --set image.tag=${{ github.sha }} \
      --namespace=production

Reusable Workflow Pattern

# .github/workflows/reusable-deploy.yml
on:
  workflow_call:
    inputs:
      service:    { required: true, type: string }
      region:     { default: 'asia-northeast1', type: string }
      image_tag:  { required: true, type: string }

permissions: { id-token: write, contents: read }

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ...
          service_account: ...
      - run: gcloud run deploy ${{ inputs.service }} --image=... --region=${{ inputs.region }}

# Consumer side
jobs:
  deploy-api:
    uses: ./.github/workflows/reusable-deploy.yml
    with:
      service:   api
      image_tag: ${{ github.sha }}

Secret Manager Integration

- id: secrets
  uses: google-github-actions/get-secretmanager-secrets@v2
  with:
    secrets: |
      DB_PASSWORD:PROJECT/db-password
      API_KEY:PROJECT/api-key

- run: ./deploy.sh
  env:
    DB_PASSWORD: ${{ steps.secrets.outputs.DB_PASSWORD }}
    API_KEY:     ${{ steps.secrets.outputs.API_KEY }}

Cloud Build Trigger Integration

- name: Trigger Cloud Build
  run: |
    gcloud builds submit --config=cloudbuild.yaml \
      --substitutions=_BRANCH=${{ github.ref_name }},_SHA=${{ github.sha }}

Self-hosted Runner (Inside VPC)

• Install the GitHub Runner on a GCE VM (Private IP)
• Reach VPC-internal resources (CloudSQL Private IP / IAP / on-prem DB)
• Larger Runners + Private Networking (GA in 2024) lets you stay on GitHub-managed runners while connecting to your VPC
• Security: destroy the VM after each job (Ephemeral)

Typical Flow

1. PR push → Actions runs lint / test / build
2. main merge → triggers Cloud Build (Container signing)
3. Push to Artifact Registry (Binary Authorization applied)
4. Create a Release in Cloud Deploy
5. Canary promotion Dev → Staging → Prod
6. Auto-rollback on SLO violation via Cloud Monitoring

Best Practices

• Never put SA keys in the repo (WIF is the only option)
• Approval gates per Environment (e.g. production)
• Standardize with Reusable Workflows
• Control concurrent runs with Concurrency settings
• Minimize OIDC token scope (Attribute Condition)
• Record build provenance with SLSA Level 3

Note: Google Cloud is a trademark of Google LLC and GitHub is a registered trademark of GitHub, Inc. For the latest details, see the google-github-actions official repository.