GitHub Actions → Google Cloud without keys: Workload Identity Federation with gcloud and Terraform
Pool + OIDC provider with issuer token.actions.githubusercontent.com and an attribute-condition on repository_owner; roles/iam.workloadIdentityUser to the repo’s principalSet; auth@v3 with workload_identity_provider and service_account. No secrets to rotate.