Repository navigation
feat(sf-org-login): add credential-source gcp, via new gcp-secret-get action - #33
Merged
Merged
Conversation
… Direct WIF Mirrors aws-secret-get's contract: authenticate via Direct Workload Identity Federation (no service account, no key file), fetch a JSON-bundle secret, export every top-level field as an uppercased, masked environment variable. Deliberately generic — field-name remapping for any specific consumer (e.g. Salesforce's username/client_id/instance_url/jwt_key shape) belongs in that consumer, not here. First consumer: sf-org-login's new gcp credential-source.
Completes the "future gcp branch" the header comment has promised since credential-source was introduced: fetch via the new gcp-secret-get action, remap its generic USERNAME/CLIENT_ID/INSTANCE_URL/JWT_KEY export to the canonical JWT_KEY_B64/USERNAME/CLIENT_ID/INSTANCE_URL shape the shared JWT login step already expects (base64-encoding JWT_KEY, since the GCP bundle stores raw PEM, not pre-encoded like the aws/github-env sources). Extends smoke-sf-org-login.yml with a credential-free rejection case for a missing gcp-workload-identity-provider, matching every other validation branch's existing coverage. First real consumer: sf-external-app-bootstrap (Gforce-Innovation-Kft), once gforce-google-infra#2 lands and its WIF trust widens to include it.
gambe94
added a commit
to Gforce-Innovation-Kft/sf-external-app-bootstrap
that referenced
this pull request
Aug 20, 2026
…workflow New src/syncGcpSecret.ts (+ npm run sync:secret) adds a new version to the existing salesforce-<env> secret after generate:jwt/setup-app run — always an upsert, since Secret Manager versions are append-only and callers read "latest". Never attempts to create the secret container itself: the write identity (gcp-secrets-admin WIF claim) only has secretVersionAdder, and all 3 known envs already have containers. New .github/workflows/setup-external-app.yml wires the whole flow end to end via workflow_dispatch: resolve-env -> setup (read via sf-org-login's new credential-source: gcp, generate a fresh keypair, create/update the External Client App, verify JWT login in a container) -> sync-secret (write the fresh keypair back). Three jobs because a job can only declare one `environment:`, and read/write use different WIF claims; the new private key crosses job boundaries as a 1-day-retention artifact, never committed or logged. Needs Gforce-Innovation-Kft/gforce-google-infra#2 (WIF trust) and Gforce-Innovation-Kft/shared-github-actions#33 (sf-org-login's gcp branch) merged before a real run will get past the login step.
This was referenced Aug 20, 2026
gambe94
added a commit
that referenced
this pull request
Aug 20, 2026
#36) sf-org-login's action.yml comment already states this; the reference doc was written before PR #33 added credential-source:gcp and didn't carry it. Root-caused for real against a live salesforce-devhub secret and a GitHub Actions run — see gforce-google-infra's docs/SECRETS.md for the seeding side of the same rule.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
gcp-secret-get: mirrorsaws-secret-get's contract exactly — Direct WIF auth (no service account, no key file), fetch a JSON-bundle secret, export every top-level field uppercased + masked. Deliberately generic, no Salesforce-specific knowledge.sf-org-logingainscredential-source: gcp— the branch its own header comment has promised sincecredential-sourcewas introduced ("A futuregcpbranch slots in beside these two without touching a single caller"). New inputsgcp-workload-identity-provider/gcp-project-id/gcp-secret-name, validated the same way theaws/github-envbranches are. A new "Stage credentials from GCP" step remapsgcp-secret-get's generic export (USERNAME/CLIENT_ID/INSTANCE_URL/JWT_KEY) to the canonicalJWT_KEY_B64/USERNAME/CLIENT_ID/INSTANCE_URLshape the shared JWT-login step already expects — base64-encodingJWT_KEY, since the GCP bundle stores raw PEM rather than pre-encoded base64 like the other two sources.smoke-sf-org-login.ymlwith a credential-free rejection case for a missinggcp-workload-identity-provider, matching the existing per-branch coverage philosophy.credential-sourcestill defaults toaws, and theazure-key-vault/unknown-value rejection case is untouched.This completes design doc Phase 8.4 (
sf-org-login'scredential-source: gcpbranch +gcp-secret-get) fromsf-develop-demo's2026-08-19-salesforce-gcp-secret-manager-design.md. First real consumer issf-external-app-bootstrap, once gforce-google-infra#2 widens WIF trust to include it.Test plan
actionlint— clean on both changed/new action manifests and the smoke workflownpm run all(format, lint, typecheck, bundle, test, dist:verify) — all green, ran automatically via the pre-push hooksmoke-sf-org-login.yml's existing rejection cases unaffected (unknown credential-source, malformed key, auth-url path)smoke-sf-org-login.yml, including the new gcp rejection casecredential-source: gcpexercised for real oncesf-external-app-bootstrap's demo workflow runs (pending gforce-google-infra#2)🤖 Generated with Claude Code