external-account-integration.yml

name: "External Account Integration"

on:
  workflow_call:
    inputs:
      checkout-ref:
        required: true
        description: "The ref we want to compile"
        type: string

permissions:
  contents: read

jobs:
  # A minimal build to validate external account (aka Workload/Workforce
  # Identity Federation, aka WIF, aka BYOID).  As the name implies, external
  # accounts support non-Google sources of identity, such as AWS, Azure, or
  # GitHub. Most of our builds use Google Cloud Build (GCB), which is not
  # usable in this case.
  identity-federation-integration-test:
    name: external-account-integration-test
    runs-on: ubuntu-24.04
    # Add "id-token" with the intended permissions.
    permissions:
      contents: read
      id-token: write

    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      with:
        ref: ${{ inputs.checkout-ref }}
    - id: auth
      uses: google-github-actions/auth@v2
      with:
        create_credentials_file: true
        credentials_json: ${{ secrets.BUILD_CACHE_KEY }}
    - name: Set up Cloud SDK
      uses: google-github-actions/setup-gcloud@v2
    - name: vcpkg-version
      id: vcpkg-version
      run: |
        echo "version=$(cat ci/etc/vcpkg-version.txt)" >> "${GITHUB_OUTPUT}"
      shell: bash
    - name: install ninja and CMake
      run: |
        rm /usr/local/bin/cmake
        sudo apt install ninja-build cmake
    - name: download-sccache
      working-directory: "${{runner.temp}}"
      run: |
        curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.7.1/sccache-v0.7.1-x86_64-unknown-linux-musl.tar.gz | \
          tar -zxf - --strip-components=1 && \
        sudo mv sccache /usr/bin/sccache && \
        sudo chmod +x /usr/bin/sccache
    - name: download-vcpkg
      working-directory: "${{runner.temp}}"
      run: |
        mkdir -p vcpkg
        curl -fsSL "https://github.com/microsoft/vcpkg/archive/${{ steps.vcpkg-version.outputs.version }}.tar.gz" |
            tar -C vcpkg --strip-components=1 -zxf -
        vcpkg/bootstrap-vcpkg.sh -disableMetrics
    # First compile the code using the identity with access to the build cache
    - run: |
        env VCPKG_ROOT="${{ runner.temp }}/vcpkg" ci/gha/builds/external-account.sh
    # Then switch to the BYOID identity and run the integration test
    - id: byoid-auth
      if: '!github.event.pull_request.head.repo.fork'
      name: 'Authenticate to GCP'
      uses: 'google-github-actions/auth@v2'
      with:
        create_credentials_file: true
        workload_identity_provider: 'projects/49427430084/locations/global/workloadIdentityPools/github-wif-pool/providers/github-wif-provider'
        service_account: 'github-actions@cloud-cpp-identity-federation.iam.gserviceaccount.com'
    - run: |
        ctest --test-dir cmake-out --output-on-failure -R common_internal_external_account_integration_test
    env:
      SCCACHE_GCS_BUCKET: cloud-cpp-gha-cache
      SCCACHE_GCS_KEY_PREFIX: sccache/ubuntu-22.04/${{ github.job }}
      SCCACHE_GCS_RW_MODE: READ_WRITE
      SCCACHE_IGNORE_SERVER_IO_ERROR: 1
      VCPKG_BINARY_SOURCES: x-gcs,gs://cloud-cpp-gha-cache/vcpkg-cache/ubuntu-22.04/${{ github.job }},readwrite