wif_setup.tf

#Workload Identity Federation
resource "google_iam_workload_identity_pool" "counter-wi-pool" {
  workload_identity_pool_id = "counter-wi-pool"
  display_name              = "Visitor Counter WI Pool"
}

resource "google_iam_workload_identity_pool_provider" "github_wi_provider" {
  workload_identity_pool_id          = google_iam_workload_identity_pool.counter-wi-pool.workload_identity_pool_id
  workload_identity_pool_provider_id = "github-provider"
  display_name                       = "GitHub Actions"
  attribute_mapping = {
    "google.subject"       = "assertion.sub"
    "attribute.actor"      = "assertion.actor"
    "attribute.repository" = "assertion.repository"
  }
  oidc {
    issuer_uri = "https://token.actions.githubusercontent.com"
  }
}

resource "google_service_account_iam_binding" "service-account-iam" {
  service_account_id = google_service_account.gh_actions_account.id
  role               = "roles/iam.workloadIdentityUser"
  members = [
    var.wif_repo
  ]
  depends_on = [
    google_service_account.gh_actions_account
  ]
}