Google Cloud Workload Identity 連携を利用してdataform cliをGithub Actions上で動かす

locals {
  state_bucket_name = "tf_state_object"
  project_id       = "projectId"
  github_org_name  = "orgName" # 個人アカウントの場合はユーザ名
  github_repo_name = "repositoryName"

  sa_roles = [
    "roles/iam.serviceAccountTokenCreator",
    "roles/secretmanager.secretAccessor",
    "roles/dataform.serviceAgent",
    "roles/bigquery.jobUser",
    "roles/bigquery.dataOwner",
    "roles/bigquery.dataEditor",
  ]
}

provider "google" {
  project = local.project_id
  region  = "US"
}

terraform {
  required_version = "1.9.0"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
  }
  backend "gcs" {
    bucket = "tf_state_object"
    prefix = "state"
  }
}

# state backend用
resource "google_storage_bucket" "terraform_state_bucket" {
  name          = "tf_state_object"
  location      = "US"
  force_destroy = true
  storage_class = "STANDARD"

  versioning {
    enabled = true
  }

  uniform_bucket_level_access = true
}

# github actionsにてなりすますサービスアカウント
resource "google_service_account" "dataform_run" {
  project      = local.project_id
  account_id   = "dataform-run"
  display_name = "dataform run"
}
resource "google_project_iam_member" "dataform_run" {
  project = local.project_id

  count  = length(local.sa_roles)
  role   = element(local.sa_roles, count.index)
  member = "serviceAccount:${google_service_account.dataform_run.email}"
}

# workload identity周りのリソース
resource "google_iam_workload_identity_pool" "github_actions" {
  project                   = local.project_id
  workload_identity_pool_id = "github-actions-pool"
}

resource "google_iam_workload_identity_pool_provider" "github_actions" {
  project                            = local.project_id
  workload_identity_pool_provider_id = "github-actions-provider"
  workload_identity_pool_id          = google_iam_workload_identity_pool.github_actions.workload_identity_pool_id
  attribute_condition                = "\"${local.github_org_name}/${local.github_repo_name}\" == assertion.repository"

  oidc {
    issuer_uri = "https://token.actions.githubusercontent.com"
  }

  attribute_mapping = {
    "google.subject"       = "assertion.sub"
    "attribute.repository" = "assertion.repository"
  }
}

# workload identityにサービスアカウントを接続
resource "google_service_account_iam_binding" "github_actions_iam_workload_identity_user" {
  service_account_id = "projects/${local.project_id}/serviceAccounts/${google_service_account.dataform_run.email}"
  role               = "roles/iam.workloadIdentityUser"
  members = [
    "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github_actions.name}/attribute.repository/${local.github_org_name}/${local.github_repo_name}",
    "principal://iam.googleapis.com/${google_iam_workload_identity_pool.github_actions.name}/subject/repo:${local.github_org_name}/${local.github_repo_name}:ref:refs/heads/main"
  ]
}

name: CI

on:
  push:
    paths:
      - definitions/**
      - includes/**
      - .github/workflows/ci.yml
permissions:
  contents: read
  id-token: write

env:
  SERVICE_ACCOUNT: "dataform-run@{projectId}.iam.gserviceaccount.com"
  PROJECT_ID: "projectId"
  WORKLOAD_IDENTITY_PROVIDER: "projects/{projectNumber}/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider"

jobs:
  dry-run:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout code into workspace directory
        uses: 'actions/checkout@v4'
      - name: Auth google cloud
        id: auth
        uses: 'google-github-actions/auth@v2'
        with:
          project_id: ${{ env.PROJECT_ID }}
          workload_identity_provider: ${{ env.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ env.SERVICE_ACCOUNT }}
          access_token_lifetime: '300s' # optional, default: '3600s' (1 hour)
      - name: With Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '18'
      - name: Install package
        run: |
          npm install -g @dataform/cli
      - name: Check dataform version
        run: dataform --version
      - name: Run dataform compile
        run: dataform compile
      - name: Dry run
        run: dataform run --dry-run