WorkloadIdentityFederationClient

actor WorkloadIdentityFederationClient

Overview

This is the required alternative wherever an organization enforces the iam.disableServiceAccountKeyCreation org policy (Google’s own “Secure by Default” recommendation), since FirebaseAppDistributionClient’s JSON-key flow depends on a downloadable key that policy blocks from ever being created.

The three-step exchange

Mirrors what google-github-actions/auth does under the hood, done natively so shipit depends on nothing beyond the GitHub Actions OIDC provider and standard Google APIs:

1. Fetch a GitHub Actions OIDC ID token, audience-bound to the workload identity provider.

2. Exchange it at Google’s STS endpoint for a federated access token scoped to the pool.

3. Use the federated token to impersonate the target service account via the IAM Credentials API, producing a cloud-platform-scoped access token.

Usage

let wif = WorkloadIdentityFederationClient(
    provider: "projects/123456789/locations/global/workloadIdentityPools/github-actions/providers/github",
    serviceAccountEmail: "firebase-app-distribution-ci@novalingo-staging.iam.gserviceaccount.com")
let token = try await wif.cachedOrNewToken()

Requires permissions: { id-token: write } on the calling GitHub Actions job — without it, ACTIONS_ID_TOKEN_REQUEST_URL/ACTIONS_ID_TOKEN_REQUEST_TOKEN are not set and step 1 throws. The calling identity also needs roles/iam.workloadIdentityUser on the target service account, scoped to the specific GitHub repository — not just pool membership — or step 3 fails with a permission-denied error.