Repository navigation
Workload identity with Service Account outdated #513
Description
TL;DR
I followed all the steps to setup my workload identity for my GH action to authenticate on GCP but it was working. I checked the logs in my IDP but no logs there.
I found out that the attribute-mapping is outdated or wrong. I've used the official documentation here and now my GH actions are able to authenticate. Might be better to just reference your documentation to this official rather than duplicate and have to keep it
Expected behavior
No response
Observed behavior
No response
Action YAML
NALog output
Additional information
No response
Activity
github-actions commentedon Aug 29, 2025
Hi there @rotarur 👋!
Thank you for opening an issue. Our team will triage this as soon as we can. Please take a moment to review the troubleshooting steps which lists common error messages and their resolution steps.
sethvargo commentedon Aug 29, 2025
What did you use before and what did you use after?
rotarur commentedon Nov 3, 2025
I used
--attribute-condition="assertion.repository_owner == '${GITHUB_ORG}'" \In the official documentation they recommend using like this
--attribute-mapping="google.subject=assertion.sub,attribute.repository=assertion.repository"