gcp-wif-secret-manager-integration

You can bootstrap GCP Secret Manager with Workload Identity Federation (WIF) in GitHub Actions using Terraform-based CI templates. This process provisions the WIF pool, provider, and service account bindings to enable zero-trust pipelines without embedding credentials.

The best way to replace broad PATs with fine-grained tokens in CI is by implementing Workload Identity Federation. This approach provisions fine-grained access without exposing credentials, enabling secure secret exchange for GitHub Actions projects.

Workload Identity Federation secures secret exchange by allowing GitHub Actions to access GCP Secret Manager without long-lived credentials. It provisions a WIF pool and provider, ensuring fine-grained access control and zero-secrets-in-code pipelines.

Yes, you can populate and rotate secrets in GCP Secret Manager without exposing credentials in code. The Skill automates secret provisioning within CI pipelines, ensuring zero-secrets-in-code through Workload Identity Federation integration.

Prerequisites for zero-trust CI include following clear ADR guidance and Phase 1 through Phase 5 steps to bootstrap WIF, create secrets, and wire CI. You need Terraform-based CI templates to provision the required infrastructure.

Yes, you need Terraform to provision the WIF pool, provider, and service account bindings for GitHub Actions CI. The Skill implements Terraform-based CI templates to automate this bootstrap process and ensure secure secret management.