Federate GitHub Actions OIDC tokens to GCP Workload Identity Federation to access GCP services

Steps

1. Create a GCP Workload Identity Pool and add a GitHub OIDC provider within it, configuring the issuer URL as https://token.actions.githubusercontent.com and mapping relevant claims (e.g., attribute.repository from assertion.repository)
2. Add an attribute condition to restrict which GitHub repositories or branches can use the pool (e.g., attribute.repository == 'org/repo')
3. Grant the pool's principal (principalSet://iam.googleapis.com/...) the Workload Identity User role on the desired service account
4. In the GitHub Actions workflow, add permissions: id-token: write and use the google-github-actions/auth action with the workload identity provider resource name and service account email
5. Subsequent GCP API calls in the workflow use the impersonated service account identity without any stored JSON key
6. Audit access via Cloud Audit Logs filtering on the workload identity pool's principalSet to detect unexpected repositories or branches authenticating