{"id":48768690,"url":"https://github.com/sparkfabrik/terraform-google-gcp-github-wif","last_synced_at":"2026-04-13T09:03:38.338Z","repository":{"id":342053114,"uuid":"1138222143","full_name":"sparkfabrik/terraform-google-gcp-github-wif","owner":"sparkfabrik","description":"Terraform module for configuring GCP Workload Identity Federation and set appropriate Github variables.","archived":false,"fork":false,"pushed_at":"2026-03-04T15:26:14.000Z","size":58,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-04T21:33:42.824Z","etag":null,"topics":["gcp","github","google-cloud-platform","iac","infrastructure-as-code","terraform-module","wif","workload-identity-federation"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sparkfabrik.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-01-20T11:52:41.000Z","updated_at":"2026-03-04T15:31:13.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/sparkfabrik/terraform-google-gcp-github-wif","commit_stats":null,"previous_names":["sparkfabrik/terraform-google-gcp-github-wif"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/sparkfabrik/terraform-google-gcp-github-wif","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sparkfabrik%2Fterraform-google-gcp-github-wif","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sparkfabrik%2Fterraform-google-gcp-github-wif/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sparkfabrik%2Fterraform-google-gcp-github-wif/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sparkfabrik%2Fterraform-google-gcp-github-wif/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sparkfabrik","download_url":"https://codeload.github.com/sparkfabrik/terraform-google-gcp-github-wif/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sparkfabrik%2Fterraform-google-gcp-github-wif/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31746116,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-13T06:26:45.479Z","status":"ssl_error","status_checked_at":"2026-04-13T06:26:44.645Z","response_time":93,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["gcp","github","google-cloud-platform","iac","infrastructure-as-code","terraform-module","wif","workload-identity-federation"],"created_at":"2026-04-13T09:03:28.112Z","updated_at":"2026-04-13T09:03:38.331Z","avatar_url":"https://github.com/sparkfabrik.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Terraform Google GCP GitHub Workload Identity Federation Module\n\nThis Terraform module sets up **Google Cloud Platform (GCP) Workload Identity Federation (WIF)** to allow GitHub Actions workflows to authenticate with GCP without using static service account keys.\n\n## Features\n\n- Creates a Workload Identity Pool and OIDC Provider for GitHub Actions\n- Supports repository-level and organization-level access control\n- Optionally creates a dedicated service account (or uses an existing one)\n- Automatically creates GitHub Actions variables with WIF configuration\n- Supports Secret Manager integration for managing secrets\n- Flexible attribute conditions for fine-grained access control\n\n## Usage\n\n### Basic Usage - Repository Level Access\n\n```hcl\nmodule \"github_wif\" {\n  source = \"github.com/sparkfabrik/terraform-google-gcp-github-wif\"\n\n  name           = \"my-github-wif\"\n  gcp_project_id = \"my-gcp-project-id\"\n\n  github_repository_names = [\"my-org/my-repo\"]\n}\n```\n\n### Organization Level Access\n\n```hcl\nmodule \"github_wif\" {\n  source = \"github.com/sparkfabrik/terraform-google-gcp-github-wif\"\n\n  name           = \"org-github-wif\"\n  gcp_project_id = \"my-gcp-project-id\"\n\n  github_organization_id = 12345678\n}\n```\n\n### Enterprise Level Access (GitHub Enterprise Cloud)\n\n\u003e **Note:** GitHub Enterprise Cloud provides additional OIDC claims (`enterprise` and `enterprise_id`).\n\u003e While this module supports enterprise-level WIF attribute conditions, the GitHub Terraform provider\n\u003e does not currently support enterprise-level Actions variables. You'll need to configure\n\u003e variables at the organization or repository level.\n\n```hcl\nmodule \"github_wif\" {\n  source = \"github.com/sparkfabrik/terraform-google-gcp-github-wif\"\n\n  name           = \"enterprise-github-wif\"\n  gcp_project_id = \"my-gcp-project-id\"\n\n  # Enterprise-level WIF access (GitHub Enterprise Cloud only)\n  github_enterprise_id = \"123456\"\n\n  # Variables must still be set at org or repo level\n  github_organization_id = 12345678\n}\n```\n\n### Organization Level Access with Selected Repositories\n\n```hcl\nmodule \"github_wif\" {\n  source = \"github.com/sparkfabrik/terraform-google-gcp-github-wif\"\n\n  name           = \"org-github-wif\"\n  gcp_project_id = \"my-gcp-project-id\"\n\n  github_organization_id = 12345678\n\n  # Only allow specific repositories to access the variables\n  github_organization_variables_visibility              = \"selected\"\n  github_organization_variables_selected_repository_ids = [123456789, 987654321]\n}\n```\n\n### With Additional Security Conditions\n\n```hcl\nmodule \"github_wif\" {\n  source = \"github.com/sparkfabrik/terraform-google-gcp-github-wif\"\n\n  name           = \"prod-deploy\"\n  gcp_project_id = \"my-gcp-project-id\"\n\n  github_repository_names = [\"my-org/my-repo\"]\n  \n  # Only allow from main branch and production environment\n  github_attribute_condition_additional = \"attribute.ref==\\\"refs/heads/main\\\" \u0026\u0026 attribute.environment==\\\"production\\\"\"\n}\n```\n\n### With Secret Manager Integration\n\n```hcl\nmodule \"github_wif\" {\n  source = \"github.com/sparkfabrik/terraform-google-gcp-github-wif\"\n\n  name           = \"my-github-wif\"\n  gcp_project_id = \"my-gcp-project-id\"\n\n  github_repository_names = [\"my-org/my-repo\"]\n  \n  secret_names = [\"api-key\", \"database-password\"]\n}\n```\n\n## GitHub Actions Workflow\n\nAfter applying this module, use the following workflow configuration:\n\n```yaml\nname: Deploy to GCP\n\non:\n  push:\n    branches: [main]\n\npermissions:\n  contents: read\n  id-token: write  # Required for OIDC authentication\n\njobs:\n  deploy:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n\n      - id: auth\n        name: Authenticate to Google Cloud\n        uses: google-github-actions/auth@v2\n        with:\n          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}\n          service_account: ${{ vars.GCP_WIF_SERVICE_ACCOUNT_EMAIL }}\n\n      - name: Set up Cloud SDK\n        uses: google-github-actions/setup-gcloud@v2\n\n      - name: Use gcloud CLI\n        run: gcloud services list\n```\n\n## GitHub OIDC Token Claims\n\nThis module maps the following GitHub OIDC token claims to GCP attributes:\n\n| GitHub Claim | GCP Attribute | Description |\n|-------------|---------------|-------------|\n| `repository` | `attribute.repository` | Full repository name (owner/repo) |\n| `repository_id` | `attribute.repository_id` | Numeric repository ID |\n| `repository_owner` | `attribute.repository_owner` | Organization or user name |\n| `repository_owner_id` | `attribute.repository_owner_id` | Numeric owner ID |\n| `repository_visibility` | `attribute.repository_visibility` | public, private, or internal |\n| `actor` | `attribute.actor` | User who triggered the workflow |\n| `actor_id` | `attribute.actor_id` | Numeric user ID |\n| `ref` | `attribute.ref` | Git ref (e.g., refs/heads/main) |\n| `ref_type` | `attribute.ref_type` | branch or tag |\n| `event_name` | `attribute.event_name` | Trigger event (push, pull_request, etc.) |\n| `workflow` | `attribute.workflow` | Workflow name |\n| `workflow_ref` | `attribute.workflow_ref` | Full workflow path with ref |\n| `job_workflow_ref` | `attribute.job_workflow_ref` | Reusable workflow reference |\n| `environment` | `attribute.environment` | Deployment environment name |\n| `runner_environment` | `attribute.runner_environment` | github-hosted or self-hosted |\n| `enterprise` | `attribute.enterprise` | Enterprise name (Enterprise Cloud only) |\n| `enterprise_id` | `attribute.enterprise_id` | Enterprise ID (Enterprise Cloud only) |\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| terraform | \u003e= 1.5 |\n| google | \u003e= 3.53 |\n| random | \u003e= 3.0 |\n| github | \u003e= 5.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| google | \u003e= 3.53 |\n| random | \u003e= 3.0 |\n| github | \u003e= 5.0 |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| name | The name to use for all resources created by this module | `string` | n/a | yes |\n| gcp_project_id | The ID of the project in which to provision resources | `string` | n/a | yes |\n| gcp_existing_service_account_account_id | The account_id of an existing service account to use | `string` | `null` | no |\n| gcp_workload_identity_pool_provider_attribute_mapping | Custom attribute mappings for the OIDC provider | `map(string)` | See variables.tf | no |\n| github_organization_id | GitHub organization ID for org-level access | `number` | `null` | no |\n| github_enterprise_id | GitHub Enterprise ID (Enterprise Cloud only) | `string` | `null` | no |\n| github_repository_ids | GitHub repository IDs for repo-level access | `list(number)` | `[]` | no |\n| github_repository_names | GitHub repository names (owner/repo format) | `list(string)` | `[]` | no |\n| github_token_issuer_url | GitHub OIDC token issuer URL | `string` | `\"https://token.actions.githubusercontent.com\"` | no |\n| github_create_oidc_variables | Whether to create GitHub Actions variables | `bool` | `true` | no |\n| github_organization_variables_visibility | Visibility for org-level variables (all, private, selected) | `string` | `\"all\"` | no |\n| github_organization_variables_selected_repository_ids | Repository IDs for selected visibility | `list(number)` | `[]` | no |\n| github_attribute_condition_additional | Additional CEL expression for attribute conditions | `string` | `null` | no |\n| github_variables_additional | Additional GitHub Actions variables to create | `map(string)` | `{}` | no |\n| secret_gcp_project_id | GCP project ID for Secret Manager | `string` | `null` | no |\n| secret_names | List of secret names to create | `list(string)` | `[]` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| workload_identity_pool_name | Full name of the Workload Identity Pool |\n| workload_identity_pool_id | ID of the Workload Identity Pool |\n| workload_identity_pool_provider_id | ID of the Workload Identity Provider |\n| workload_identity_provider | Full resource path for google-github-actions/auth |\n| service_account_email | Email of the Service Account |\n| principal_set | Principal sets for IAM bindings |\n| attribute_condition | The attribute condition used |\n| github_actions_variables | Map of GitHub Actions variables created |\n| secret_names | Map of secret names to formatted names |\n| secret_project_id | GCP project ID where secrets are stored |\n| secret_created | Names and IDs of created secrets |\n| secret_ids | Map of secret names to Secret Manager IDs |\n\n## Security Considerations\n\n1. **Principle of Least Privilege**: Use repository-level access instead of organization-level when possible\n2. **Branch Protection**: Add branch conditions to limit access to protected branches\n3. **Environment Protection**: Use GitHub environments with protection rules\n4. **Attribute Conditions**: Use `github_attribute_condition_additional` to add extra restrictions\n\n## Example Attribute Conditions\n\n```hcl\n# Only main branch\ngithub_attribute_condition_additional = \"attribute.ref==\\\"refs/heads/main\\\"\"\n\n# Only production environment\ngithub_attribute_condition_additional = \"attribute.environment==\\\"production\\\"\"\n\n# Only github-hosted runners\ngithub_attribute_condition_additional = \"attribute.runner_environment==\\\"github-hosted\\\"\"\n\n# Combined conditions\ngithub_attribute_condition_additional = \"attribute.ref==\\\"refs/heads/main\\\" \u0026\u0026 attribute.environment==\\\"production\\\"\"\n```\n\n## License\n\nApache 2.0 - See LICENSE for more information.\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_github\"\u003e\u003c/a\u003e [github](#provider\\_github) | \u003e= 5.0 |\n| \u003ca name=\"provider_google\"\u003e\u003c/a\u003e [google](#provider\\_google) | \u003e= 3.53 |\n| \u003ca name=\"provider_random\"\u003e\u003c/a\u003e [random](#provider\\_random) | \u003e= 3.0 |\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.5 |\n| \u003ca name=\"requirement_github\"\u003e\u003c/a\u003e [github](#requirement\\_github) | \u003e= 5.0 |\n| \u003ca name=\"requirement_google\"\u003e\u003c/a\u003e [google](#requirement\\_google) | \u003e= 3.53 |\n| \u003ca name=\"requirement_random\"\u003e\u003c/a\u003e [random](#requirement\\_random) | \u003e= 3.0 |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_gcp_existing_service_account_account_id\"\u003e\u003c/a\u003e [gcp\\_existing\\_service\\_account\\_account\\_id](#input\\_gcp\\_existing\\_service\\_account\\_account\\_id) | The account\\_id of an existing service account to use for GitHub WIF. If not provided, a new service account will be created. | `string` | `null` | no |\n| \u003ca name=\"input_gcp_project_id\"\u003e\u003c/a\u003e [gcp\\_project\\_id](#input\\_gcp\\_project\\_id) | The ID of the project in which to provision resources. | `string` | n/a | yes |\n| \u003ca name=\"input_gcp_workload_identity_pool_provider_attribute_mapping\"\u003e\u003c/a\u003e [gcp\\_workload\\_identity\\_pool\\_provider\\_attribute\\_mapping](#input\\_gcp\\_workload\\_identity\\_pool\\_provider\\_attribute\\_mapping) | A map of attribute mappings for the GCP Workload Identity Federation provider. This allows you to customize how attributes are mapped from GitHub to GCP. | `map(string)` | \u003cpre\u003e{\u003cbr/\u003e  \"attribute.actor\": \"assertion.actor\",\u003cbr/\u003e  \"attribute.actor_id\": \"assertion.actor_id\",\u003cbr/\u003e  \"attribute.enterprise\": \"assertion.enterprise\",\u003cbr/\u003e  \"attribute.enterprise_id\": \"assertion.enterprise_id\",\u003cbr/\u003e  \"attribute.environment\": \"assertion.environment\",\u003cbr/\u003e  \"attribute.event_name\": \"assertion.event_name\",\u003cbr/\u003e  \"attribute.job_workflow_ref\": \"assertion.job_workflow_ref\",\u003cbr/\u003e  \"attribute.ref\": \"assertion.ref\",\u003cbr/\u003e  \"attribute.ref_type\": \"assertion.ref_type\",\u003cbr/\u003e  \"attribute.repository\": \"assertion.repository\",\u003cbr/\u003e  \"attribute.repository_id\": \"assertion.repository_id\",\u003cbr/\u003e  \"attribute.repository_owner\": \"assertion.repository_owner\",\u003cbr/\u003e  \"attribute.repository_owner_id\": \"assertion.repository_owner_id\",\u003cbr/\u003e  \"attribute.repository_visibility\": \"assertion.repository_visibility\",\u003cbr/\u003e  \"attribute.runner_environment\": \"assertion.runner_environment\",\u003cbr/\u003e  \"attribute.workflow\": \"assertion.workflow\",\u003cbr/\u003e  \"attribute.workflow_ref\": \"assertion.workflow_ref\",\u003cbr/\u003e  \"google.subject\": \"assertion.actor+\\\"::run:\\\"+assertion.run_id+\\\"::attempt:\\\"+assertion.run_attempt\"\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_github_attribute_condition_additional\"\u003e\u003c/a\u003e [github\\_attribute\\_condition\\_additional](#input\\_github\\_attribute\\_condition\\_additional) | Additional CEL expression to AND with the generated attribute condition. Use this to add extra restrictions like branch filters, environment filters, etc. | `string` | `null` | no |\n| \u003ca name=\"input_github_create_oidc_variables\"\u003e\u003c/a\u003e [github\\_create\\_oidc\\_variables](#input\\_github\\_create\\_oidc\\_variables) | Whether to create GitHub Actions variables for the WIF configuration. Set to false if you want to manage variables manually. | `bool` | `true` | no |\n| \u003ca name=\"input_github_enterprise_id\"\u003e\u003c/a\u003e [github\\_enterprise\\_id](#input\\_github\\_enterprise\\_id) | The GitHub Enterprise ID to allow access from. Only available with GitHub Enterprise Cloud. | `string` | `null` | no |\n| \u003ca name=\"input_github_gcp_wif_pool_variable_name\"\u003e\u003c/a\u003e [github\\_gcp\\_wif\\_pool\\_variable\\_name](#input\\_github\\_gcp\\_wif\\_pool\\_variable\\_name) | The name of the GitHub Actions variable to store the GCP WIF pool name. | `string` | `\"GCP_WIF_POOL\"` | no |\n| \u003ca name=\"input_github_gcp_wif_project_id_variable_name\"\u003e\u003c/a\u003e [github\\_gcp\\_wif\\_project\\_id\\_variable\\_name](#input\\_github\\_gcp\\_wif\\_project\\_id\\_variable\\_name) | The name of the GitHub Actions variable to store the GCP project ID for WIF. | `string` | `\"GCP_WIF_PROJECT_ID\"` | no |\n| \u003ca name=\"input_github_gcp_wif_provider_variable_name\"\u003e\u003c/a\u003e [github\\_gcp\\_wif\\_provider\\_variable\\_name](#input\\_github\\_gcp\\_wif\\_provider\\_variable\\_name) | The name of the GitHub Actions variable to store the GCP WIF provider name. | `string` | `\"GCP_WIF_PROVIDER\"` | no |\n| \u003ca name=\"input_github_gcp_wif_service_account_email_variable_name\"\u003e\u003c/a\u003e [github\\_gcp\\_wif\\_service\\_account\\_email\\_variable\\_name](#input\\_github\\_gcp\\_wif\\_service\\_account\\_email\\_variable\\_name) | The name of the GitHub Actions variable to store the GCP WIF service account email. | `string` | `\"GCP_WIF_SERVICE_ACCOUNT_EMAIL\"` | no |\n| \u003ca name=\"input_github_gcp_wif_workload_identity_provider_variable_name\"\u003e\u003c/a\u003e [github\\_gcp\\_wif\\_workload\\_identity\\_provider\\_variable\\_name](#input\\_github\\_gcp\\_wif\\_workload\\_identity\\_provider\\_variable\\_name) | The name of the GitHub Actions variable to store the full workload identity provider path (used by google-github-actions/auth). | `string` | `\"GCP_WORKLOAD_IDENTITY_PROVIDER\"` | no |\n| \u003ca name=\"input_github_organization_id\"\u003e\u003c/a\u003e [github\\_organization\\_id](#input\\_github\\_organization\\_id) | The GitHub organization ID to allow access from. Use this for organization-level access. | `number` | `null` | no |\n| \u003ca name=\"input_github_organization_variables_selected_repository_ids\"\u003e\u003c/a\u003e [github\\_organization\\_variables\\_selected\\_repository\\_ids](#input\\_github\\_organization\\_variables\\_selected\\_repository\\_ids) | List of repository IDs that can access organization-level variables. Only used when github\\_organization\\_variables\\_visibility is 'selected'. | `list(number)` | `[]` | no |\n| \u003ca name=\"input_github_organization_variables_visibility\"\u003e\u003c/a\u003e [github\\_organization\\_variables\\_visibility](#input\\_github\\_organization\\_variables\\_visibility) | Visibility level for organization-level variables. Valid values: all, private, selected. | `string` | `\"all\"` | no |\n| \u003ca name=\"input_github_repository_ids\"\u003e\u003c/a\u003e [github\\_repository\\_ids](#input\\_github\\_repository\\_ids) | The GitHub repository IDs to allow access from. Use this for repository-level access. | `list(number)` | `[]` | no |\n| \u003ca name=\"input_github_repository_names\"\u003e\u003c/a\u003e [github\\_repository\\_names](#input\\_github\\_repository\\_names) | The GitHub repository names (in format 'owner/repo') to allow access from. Use this for repository-level access when you prefer to use repository names instead of IDs. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_github_token_issuer_url\"\u003e\u003c/a\u003e [github\\_token\\_issuer\\_url](#input\\_github\\_token\\_issuer\\_url) | The URL of the GitHub OIDC token issuer. | `string` | `\"https://token.actions.githubusercontent.com\"` | no |\n| \u003ca name=\"input_github_variables_additional\"\u003e\u003c/a\u003e [github\\_variables\\_additional](#input\\_github\\_variables\\_additional) | Additional GitHub Actions variables to create. This should be a map where the key is the variable name and the value is the variable value. | `map(string)` | `{}` | no |\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input\\_name) | The name to use for all resources created by this module. | `string` | n/a | yes |\n| \u003ca name=\"input_secret_gcp_project_id\"\u003e\u003c/a\u003e [secret\\_gcp\\_project\\_id](#input\\_secret\\_gcp\\_project\\_id) | The GCP project ID where secrets will be created. If not provided, defaults to `var.gcp_project_id`. | `string` | `null` | no |\n| \u003ca name=\"input_secret_names\"\u003e\u003c/a\u003e [secret\\_names](#input\\_secret\\_names) | List of secret names to create and grant access to. | `list(string)` | `[]` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_attribute_condition\"\u003e\u003c/a\u003e [attribute\\_condition](#output\\_attribute\\_condition) | The attribute condition used for the Workload Identity Provider. |\n| \u003ca name=\"output_github_actions_variables\"\u003e\u003c/a\u003e [github\\_actions\\_variables](#output\\_github\\_actions\\_variables) | The GitHub Actions variables created by this module. |\n| \u003ca name=\"output_principal_set\"\u003e\u003c/a\u003e [principal\\_set](#output\\_principal\\_set) | The principal sets string used for IAM bindings. |\n| \u003ca name=\"output_secret_created\"\u003e\u003c/a\u003e [secret\\_created](#output\\_secret\\_created) | The names and IDs of the secrets created by this module. |\n| \u003ca name=\"output_secret_gcp_project_id\"\u003e\u003c/a\u003e [secret\\_gcp\\_project\\_id](#output\\_secret\\_gcp\\_project\\_id) | The GCP project ID where secrets are stored. |\n| \u003ca name=\"output_secret_ids\"\u003e\u003c/a\u003e [secret\\_ids](#output\\_secret\\_ids) | Map of original secret names to their Secret Manager secret IDs. |\n| \u003ca name=\"output_secret_names\"\u003e\u003c/a\u003e [secret\\_names](#output\\_secret\\_names) | Map of original secret names to their formatted names. |\n| \u003ca name=\"output_service_account_email\"\u003e\u003c/a\u003e [service\\_account\\_email](#output\\_service\\_account\\_email) | The email of the Service Account used. |\n| \u003ca name=\"output_workload_identity_pool_id\"\u003e\u003c/a\u003e [workload\\_identity\\_pool\\_id](#output\\_workload\\_identity\\_pool\\_id) | The ID of the Workload Identity Pool. |\n| \u003ca name=\"output_workload_identity_pool_name\"\u003e\u003c/a\u003e [workload\\_identity\\_pool\\_name](#output\\_workload\\_identity\\_pool\\_name) | The full name of the Workload Identity Pool. |\n| \u003ca name=\"output_workload_identity_pool_provider_id\"\u003e\u003c/a\u003e [workload\\_identity\\_pool\\_provider\\_id](#output\\_workload\\_identity\\_pool\\_provider\\_id) | The ID of the Workload Identity Provider. |\n| \u003ca name=\"output_workload_identity_provider\"\u003e\u003c/a\u003e [workload\\_identity\\_provider](#output\\_workload\\_identity\\_provider) | The full resource path of the Workload Identity Provider (for use with google-github-actions/auth). |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [github_actions_organization_variable.additional](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_organization_variable) | resource |\n| [github_actions_organization_variable.gcp_wif_pool](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_organization_variable) | resource |\n| [github_actions_organization_variable.gcp_wif_project_number](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_organization_variable) | resource |\n| [github_actions_organization_variable.gcp_wif_provider](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_organization_variable) | resource |\n| [github_actions_organization_variable.gcp_wif_service_account_email](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_organization_variable) | resource |\n| [github_actions_organization_variable.gcp_workload_identity_provider](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_organization_variable) | resource |\n| [github_actions_variable.additional](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_variable) | resource |\n| [github_actions_variable.gcp_wif_pool](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_variable) | resource |\n| [github_actions_variable.gcp_wif_project_number](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_variable) | resource |\n| [github_actions_variable.gcp_wif_provider](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_variable) | resource |\n| [github_actions_variable.gcp_wif_service_account_email](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_variable) | resource |\n| [github_actions_variable.gcp_workload_identity_provider](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_variable) | resource |\n| [google_iam_workload_identity_pool.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool) | resource |\n| [google_iam_workload_identity_pool_provider.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool_provider) | resource |\n| [google_secret_manager_secret.secrets](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret) | resource |\n| [google_secret_manager_secret_iam_member.secrets](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret_iam_member) | resource |\n| [google_service_account.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource |\n| [google_service_account_iam_member.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_iam_member) | resource |\n| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |\n| [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |\n| [google_service_account.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/service_account) | data source |\n\n## Modules\n\nNo modules.\n\n\u003c!-- END_TF_DOCS --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsparkfabrik%2Fterraform-google-gcp-github-wif","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsparkfabrik%2Fterraform-google-gcp-github-wif","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsparkfabrik%2Fterraform-google-gcp-github-wif/lists"}