Skip to content

Commit d81ae62

Browse files
HassanJasimHassanJasim
authored
Adding Vertex auth (#18)
Adding the ability to authenticate with vertex on GCP
1 parent b0f0ba9 commit d81ae62

12 files changed

Lines changed: 94 additions & 35 deletions

‎.github/workflows/gemini-cli.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,9 @@ jobs:
176176
GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
177177
OTLP_GCP_WIF_PROVIDER: '${{ vars.OTLP_GCP_WIF_PROVIDER }}'
178178
OTLP_GOOGLE_CLOUD_PROJECT: '${{ vars.OTLP_GOOGLE_CLOUD_PROJECT }}'
179+
GOOGLE_CLOUD_PROJECT: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
180+
GOOGLE_CLOUD_LOCATION: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
181+
GOOGLE_GENAI_USE_VERTEXAI: '${{ vars.GOOGLE_GENAI_USE_VERTEXAI }}'
179182
with:
180183
settings_json: |
181184
{

‎.github/workflows/gemini-issue-automated-triage.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,9 @@ jobs:
6767
OTLP_GOOGLE_CLOUD_PROJECT: '${{ vars.OTLP_GOOGLE_CLOUD_PROJECT }}'
6868
OTLP_GCP_WIF_PROVIDER: '${{ vars.OTLP_GCP_WIF_PROVIDER }}'
6969
GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
70+
GOOGLE_CLOUD_PROJECT: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
71+
GOOGLE_CLOUD_LOCATION: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
72+
GOOGLE_GENAI_USE_VERTEXAI: '${{ vars.GOOGLE_GENAI_USE_VERTEXAI }}'
7073
with:
7174
settings_json: |-
7275
{

‎.github/workflows/gemini-issue-scheduled-triage.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,9 @@ jobs:
7575
OTLP_GOOGLE_CLOUD_PROJECT: '${{ vars.OTLP_GOOGLE_CLOUD_PROJECT }}'
7676
OTLP_GCP_WIF_PROVIDER: '${{ vars.OTLP_GCP_WIF_PROVIDER }}'
7777
GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
78+
GOOGLE_CLOUD_PROJECT: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
79+
GOOGLE_CLOUD_LOCATION: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
80+
GOOGLE_GENAI_USE_VERTEXAI: '${{ vars.GOOGLE_GENAI_USE_VERTEXAI }}'
7881
with:
7982
settings_json: |-
8083
{

‎.github/workflows/gemini-pr-review.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,9 @@ jobs:
154154
OTLP_GOOGLE_CLOUD_PROJECT: '${{ vars.OTLP_GOOGLE_CLOUD_PROJECT }}'
155155
OTLP_GCP_WIF_PROVIDER: '${{ vars.OTLP_GCP_WIF_PROVIDER }}'
156156
GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
157+
GOOGLE_CLOUD_PROJECT: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
158+
GOOGLE_CLOUD_LOCATION: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
159+
GOOGLE_GENAI_USE_VERTEXAI: '${{ vars.GOOGLE_GENAI_USE_VERTEXAI }}'
157160
with:
158161
settings_json: |-
159162
{

‎README.md‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,9 @@ Set the following environment variables in your repository or workflow:
8181
| GEMINI_CLI_VERSION | Controls which version of the Gemini CLI is installed. Supports npm versions (e.g., `0.1.0`, `latest`), a branch name (e.g., `main`), or a commit hash. | Variable | No | To pin or override CLI version |
8282
| OTLP_GCP_WIF_PROVIDER | The full resource name of the Workload Identity Provider. | Variable | No | If using observability |
8383
| OTLP_GOOGLE_CLOUD_PROJECT | The Google Cloud project for telemetry. | Variable | No | If using observability |
84+
| GOOGLE_CLOUD_PROJECT | The Google Cloud project for Vertex auth. | Variable | No | If using Vertex auth |
85+
| GOOGLE_CLOUD_LOCATION | The location of the Google Cloud project for Vertex auth. | Variable | No | If using Vertex auth |
86+
| GOOGLE_GENAI_USE_VERTEXAI | Set to 'true' to use Vertex AI | Variable | No | If using Vertex auth |
8487
| APP_ID | GitHub App ID for custom authentication. | Variable | No | If using a custom GitHub App |
8588

8689

@@ -93,10 +96,10 @@ save. For organization-wide or environment-specific variables, see the
9396

9497
The following secrets are required for security:
9598

96-
| Name | Description | Required | When Required |
97-
|-------------------|-----------------------------------------------|----------|------------------------------|
98-
| GEMINI_API_KEY | Your Gemini API key. | Yes | Always |
99-
| APP_PRIVATE_KEY | Private key for your GitHub App (PEM format). | No | If using a custom GitHub App |
99+
| Name | Description | Required | When Required |
100+
|-------------------|-----------------------------------------------|----------|----------------------------------------|
101+
| GEMINI_API_KEY | Your Gemini API key. | No | If using API key from AI Studio |
102+
| APP_PRIVATE_KEY | Private key for your GitHub App (PEM format). | No | If using a custom GitHub App |
100103

101104
To add a secret, go to your repository's **Settings > Secrets and variables >
102105
Actions > New repository secret**. For more information, see the

‎action.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,12 @@ runs:
8888
npm install -g @google/gemini-cli@$VERSION_INPUT
8989
else
9090
echo "Installing Gemini CLI from GitHub: github:google-gemini/gemini-cli#$VERSION_INPUT"
91-
npm install -g github:google-gemini/gemini-cli#$VERSION_INPUT
91+
git clone https://github.com/google-gemini/gemini-cli.git
92+
cd gemini-cli
93+
git checkout $VERSION_INPUT
94+
npm install
95+
npm run bundle
96+
npm install -g .
9297
fi
9398
echo "Verifying installation:"
9499
if command -v gemini >/dev/null 2>&1; then
@@ -112,6 +117,9 @@ runs:
112117
env:
113118
GEMINI_API_KEY: '${{ env.GEMINI_API_KEY }}'
114119
SURFACE: 'GitHub'
120+
GOOGLE_CLOUD_PROJECT: '${{ env.GOOGLE_CLOUD_PROJECT }}'
121+
GOOGLE_CLOUD_LOCATION: '${{ env.GOOGLE_CLOUD_LOCATION }}'
122+
GOOGLE_GENAI_USE_VERTEXAI: '${{ env.GOOGLE_GENAI_USE_VERTEXAI }}'
115123
PROMPT: '${{ inputs.prompt }}'
116124

117125
branding:

‎docs/workload-identity.md‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,8 @@ Your user account needs these permissions in the target GCP project:
7171
| Option | Description | Example |
7272
|--------|-------------|---------|
7373
| `--repo OWNER/REPO` | **Required**: GitHub repository | `--repo google/my-repo` |
74-
| `--project PROJECT_ID` | GCP project ID (auto-detected if not provided) | `--project my-gcp-project` |
74+
| `--project GOOGLE_CLOUD_PROJECT` | GCP project ID (auto-detected if not provided) | `--project my-gcp-project` |
75+
| `--location GOOGLE_CLOUD_LOCATION` | GCP project Location (defaults to 'global') | `--location us-east1` |
7576
| `--pool-name NAME` | Custom pool name (default: `github`) | `--pool-name my-pool` |
7677
| `--help` | Show help message | |
7778

@@ -84,6 +85,9 @@ Your user account needs these permissions in the target GCP project:
8485
# With specific project
8586
./scripts/setup_workload_identity.sh --repo google/my-repo --project my-gcp-project
8687

88+
# With specific project location
89+
./scripts/setup_workload_identity.sh --repo google/my-repo --location us-east1
90+
8791
# Custom pool name
8892
./scripts/setup_workload_identity.sh --repo google/my-repo --pool-name my-custom-pool
8993
```
@@ -99,14 +103,16 @@ Your user account needs these permissions in the target GCP project:
99103
## GitHub Configuration
100104

101105

102-
After running the script, add these **2 environment variables** to your repository or workflow configuration:
106+
After running the script, add these **4 environment variables** to your repository or workflow configuration:
103107

104108
Go to: `https://github.com/OWNER/REPO/settings/variables/actions`
105109

106110
| Environment Variable Name | Description |
107111
|-----------------------------------|--------------------------------------------------|
108-
| `OTLP_GCP_WIF_PROVIDER` | Workload Identity Provider resource name |
109-
| `OTLP_GOOGLE_CLOUD_PROJECT` | Your Google Cloud project ID |
112+
| `OTLP_GCP_WIF_PROVIDER` | Workload Identity Provider resource name |
113+
| `OTLP_GOOGLE_CLOUD_PROJECT` | Your Google Cloud project ID |
114+
| `GOOGLE_CLOUD_PROJECT` | Your Google Cloud project ID |
115+
| `GOOGLE_CLOUD_LOCATION` | Your Google Cloud project Location |
110116

111117
## Additional Resources
112118

‎scripts/setup_workload_identity.sh‎

Lines changed: 44 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,8 @@ print_header() {
5151
}
5252

5353
# Default values
54-
GCP_PROJECT_ID=""
54+
GOOGLE_CLOUD_PROJECT=""
55+
GOOGLE_CLOUD_LOCATION="global"
5556
GITHUB_REPO=""
5657
POOL_NAME="github"
5758

@@ -99,13 +100,17 @@ while [[ $# -gt 0 ]]; do
99100
shift 2
100101
;;
101102
-p|--project)
102-
GCP_PROJECT_ID="$2"
103+
GOOGLE_CLOUD_PROJECT="$2"
103104
shift 2
104105
;;
105106
--pool-name)
106107
POOL_NAME="$2"
107108
shift 2
108109
;;
110+
-l|--location)
111+
GOOGLE_CLOUD_LOCATION="$2"
112+
shift 2
113+
;;
109114
-h|--help)
110115
show_help
111116
exit 0
@@ -139,17 +144,17 @@ if [[ ! "${GITHUB_REPO}" =~ ^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+$ ]]; then
139144
fi
140145

141146
# Auto-detect project ID if not provided
142-
if [[ -z "${GCP_PROJECT_ID}" ]]; then
147+
if [[ -z "${GOOGLE_CLOUD_PROJECT}" ]]; then
143148
print_info "Auto-detecting Google Cloud project..."
144-
GCP_PROJECT_ID=$(gcloud config get-value project 2>/dev/null)
145-
if [[ -z "${GCP_PROJECT_ID}" ]]; then
149+
GOOGLE_CLOUD_PROJECT=$(gcloud config get-value project 2>/dev/null)
150+
if [[ -z "${GOOGLE_CLOUD_PROJECT}" ]]; then
146151
print_error "Could not auto-detect Google Cloud project ID"
147152
echo "Please either:"
148153
echo " 1. Set default project: gcloud config set project YOUR_PROJECT_ID"
149154
echo " 2. Use --project flag: $0 --repo ${GITHUB_REPO} --project YOUR_PROJECT_ID"
150155
exit 1
151156
fi
152-
print_success "Using project: ${GCP_PROJECT_ID}"
157+
print_success "Using project: ${GOOGLE_CLOUD_PROJECT}"
153158
fi
154159

155160
# Extract repository components
@@ -164,7 +169,7 @@ PROVIDER_NAME="gh-${REPO_HASH}"
164169

165170
print_header "Starting Direct Workload Identity Federation setup"
166171
echo "📦 Repository: ${GITHUB_REPO}"
167-
echo "☁️ Project: ${GCP_PROJECT_ID}"
172+
echo "☁️ Project: ${GOOGLE_CLOUD_PROJECT}"
168173
echo "🏊 Pool: ${POOL_NAME}"
169174
echo "🆔 Provider: ${PROVIDER_NAME}"
170175
echo ""
@@ -180,8 +185,8 @@ if [[ -z "${GCLOUD_AUTH_LIST}" ]]; then
180185
fi
181186

182187
# Test project access
183-
if ! gcloud projects describe "${GCP_PROJECT_ID}" > /dev/null 2>&1; then
184-
print_error "Cannot access project '${GCP_PROJECT_ID}'"
188+
if ! gcloud projects describe "${GOOGLE_CLOUD_PROJECT}" > /dev/null 2>&1; then
189+
print_error "Cannot access project '${GOOGLE_CLOUD_PROJECT}'"
185190
echo "Please verify:"
186191
echo " 1. Project ID is correct"
187192
echo " 2. You have permissions on this project"
@@ -196,18 +201,18 @@ print_header "Step 1: Enabling required Google Cloud APIs"
196201
apis_to_enable="iamcredentials.googleapis.com cloudresourcemanager.googleapis.com iam.googleapis.com sts.googleapis.com logging.googleapis.com monitoring.googleapis.com cloudtrace.googleapis.com"
197202

198203
print_info "Enabling APIs: ${apis_to_enable}"
199-
gcloud services enable "${apis_to_enable}" --project="${GCP_PROJECT_ID}"
204+
gcloud services enable "${apis_to_enable}" --project="${GOOGLE_CLOUD_PROJECT}"
200205
print_success "APIs enabled successfully"
201206

202207
# Step 2: Create Workload Identity Pool
203208
print_header "Step 2: Creating Workload Identity Pool"
204209
if ! gcloud iam workload-identity-pools describe "${POOL_NAME}" \
205-
--project="${GCP_PROJECT_ID}" \
206-
--location="global" &> /dev/null; then
210+
--project="${GOOGLE_CLOUD_PROJECT}" \
211+
--location="${GOOGLE_CLOUD_LOCATION}" &> /dev/null; then
207212
print_info "Creating Workload Identity Pool: ${POOL_NAME}"
208213
gcloud iam workload-identity-pools create "${POOL_NAME}" \
209-
--project="${GCP_PROJECT_ID}" \
210-
--location="global" \
214+
--project="${GOOGLE_CLOUD_PROJECT}" \
215+
--location="${GOOGLE_CLOUD_LOCATION}" \
211216
--display-name="GitHub Actions Pool"
212217
print_success "Workload Identity Pool created"
213218
else
@@ -216,22 +221,22 @@ fi
216221

217222
# Get the pool ID
218223
WIF_POOL_ID=$(gcloud iam workload-identity-pools describe "${POOL_NAME}" \
219-
--project="${GCP_PROJECT_ID}" \
220-
--location="global" \
224+
--project="${GOOGLE_CLOUD_PROJECT}" \
225+
--location="${GOOGLE_CLOUD_LOCATION}" \
221226
--format="value(name)")
222227

223228
# Step 3: Create Workload Identity Provider
224229
print_header "Step 3: Creating Workload Identity Provider"
225230
ATTRIBUTE_CONDITION="assertion.repository_owner == '${REPO_OWNER}'"
226231

227232
if ! gcloud iam workload-identity-pools providers describe "${PROVIDER_NAME}" \
228-
--project="${GCP_PROJECT_ID}" \
229-
--location="global" \
233+
--project="${GOOGLE_CLOUD_PROJECT}" \
234+
--location="${GOOGLE_CLOUD_LOCATION}" \
230235
--workload-identity-pool="${POOL_NAME}" &> /dev/null; then
231236
print_info "Creating Workload Identity Provider: ${PROVIDER_NAME}"
232237
gcloud iam workload-identity-pools providers create-oidc "${PROVIDER_NAME}" \
233-
--project="${GCP_PROJECT_ID}" \
234-
--location="global" \
238+
--project="${GOOGLE_CLOUD_PROJECT}" \
239+
--location="${GOOGLE_CLOUD_LOCATION}" \
235240
--workload-identity-pool="${POOL_NAME}" \
236241
--display-name="${PROVIDER_NAME}" \
237242
--attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner" \
@@ -250,29 +255,36 @@ print_info "Granting standard CI/CD permissions directly to the Workload Identit
250255

251256
# Core observability permissions
252257
print_info "Granting logging permissions..."
253-
gcloud projects add-iam-policy-binding "${GCP_PROJECT_ID}" \
258+
gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
254259
--role="roles/logging.logWriter" \
255260
--member="${PRINCIPAL_SET}" \
256261
--condition=None
257262

258263
print_info "Granting monitoring permissions..."
259-
gcloud projects add-iam-policy-binding "${GCP_PROJECT_ID}" \
264+
gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
260265
--role="roles/monitoring.editor" \
261266
--member="${PRINCIPAL_SET}" \
262267
--condition=None
263268

264269
print_info "Granting tracing permissions..."
265-
gcloud projects add-iam-policy-binding "${GCP_PROJECT_ID}" \
270+
gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
266271
--role="roles/cloudtrace.agent" \
267272
--member="${PRINCIPAL_SET}" \
268273
--condition=None
269274

275+
276+
print_info "Granting vertex permissions..."
277+
gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
278+
--role="roles/aiplatform.user" \
279+
--member="${PRINCIPAL_SET}" \
280+
--condition=None
281+
270282
print_success "Standard permissions granted to Workload Identity Pool"
271283

272284
# Get the full provider name for output
273285
WIF_PROVIDER_FULL=$(gcloud iam workload-identity-pools providers describe "${PROVIDER_NAME}" \
274-
--project="${GCP_PROJECT_ID}" \
275-
--location="global" \
286+
--project="${GOOGLE_CLOUD_PROJECT}" \
287+
--location="${GOOGLE_CLOUD_LOCATION}" \
276288
--workload-identity-pool="${POOL_NAME}" \
277289
--format="value(name)")
278290

@@ -299,7 +311,13 @@ echo "🔑 Variable Name: OTLP_GCP_WIF_PROVIDER"
299311
echo " Value: ${WIF_PROVIDER_FULL}"
300312
echo ""
301313
echo "☁️ Variable Name: OTLP_GOOGLE_CLOUD_PROJECT"
302-
echo " Value: ${GCP_PROJECT_ID}"
314+
echo " Value: ${GOOGLE_CLOUD_PROJECT}"
315+
echo ""
316+
echo "☁️ Secret Name: GOOGLE_CLOUD_LOCATION"
317+
echo " Secret Value: ${GOOGLE_CLOUD_LOCATION}"
318+
echo ""
319+
echo "☁️ Secret Name: GOOGLE_CLOUD_PROJECT"
320+
echo " Secret Value: ${GOOGLE_CLOUD_PROJECT}"
303321
echo ""
304322

305323
print_success "Setup completed successfully! 🚀"

‎workflows/gemini-cli/gemini-cli.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,9 @@ jobs:
176176
GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
177177
OTLP_GCP_WIF_PROVIDER: '${{ vars.OTLP_GCP_WIF_PROVIDER }}'
178178
OTLP_GOOGLE_CLOUD_PROJECT: '${{ vars.OTLP_GOOGLE_CLOUD_PROJECT }}'
179+
GOOGLE_CLOUD_PROJECT: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
180+
GOOGLE_CLOUD_LOCATION: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
181+
GOOGLE_GENAI_USE_VERTEXAI: '${{ vars.GOOGLE_GENAI_USE_VERTEXAI }}'
179182
with:
180183
settings_json: |
181184
{

‎workflows/issue-triage/gemini-issue-automated-triage.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,9 @@ jobs:
6767
OTLP_GOOGLE_CLOUD_PROJECT: '${{ vars.OTLP_GOOGLE_CLOUD_PROJECT }}'
6868
OTLP_GCP_WIF_PROVIDER: '${{ vars.OTLP_GCP_WIF_PROVIDER }}'
6969
GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
70+
GOOGLE_CLOUD_PROJECT: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
71+
GOOGLE_CLOUD_LOCATION: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
72+
GOOGLE_GENAI_USE_VERTEXAI: '${{ vars.GOOGLE_GENAI_USE_VERTEXAI }}'
7073
with:
7174
settings_json: |-
7275
{

0 commit comments

Comments
 (0)