Default auth_token expiration is 5 minutes instead of 10 minutes #474
Description
TL;DR
When using Direct Workload Identity Federation, the default expiration time for the auth_token is 5 minutes instead of 10 (which is what's been written in the documentation).
Expected behavior
The expectation would be for the token to be valid for 10 minutes as mentioned in the README.md file in the root.
Observed behavior
If I try to print the OIDC JWT token in GitHub Actions, I get:
{
"actor": "dsotirakis",
"aud": "https://github.com/org",
"base_ref": "main",
"event_name": "pull_request",
"exp": 1741684978,
"iat": 1741684678,
}The ttl for the token then is exp-iat= 300s = 5m.
If I run some steps that takes more than 5 minutes after I get authenticated, I get:
#30 ERROR: failed to push us-docker.pkg.dev[...]: failed to authorize: failed to fetch oauth token: unexpected status from GET request to https://us-docker.pkg.dev/v2/token?scope=repository%[...]%[...]%[...]%3Apull%2Cpush&service=us-docker.pkg.dev: 401 Unauthorized
which agrees with the token expiration.
Action YAML
build:
name: Build and publish mlops-lab
runs-on: ubuntu-latest
strategy:
matrix:
platform: [linux/amd64, linux/arm64]
steps:
- uses: actions/checkout@v4
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Login to Google Artifact Registry
uses: google-github-actions/auth@v2
with:
workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
service_account: ${{ secrets.SERVICE_ACCOUNT_EMAIL }}
- name: Set up gcloud CLI
uses: google-github-actions/setup-gcloud@v2
- name: Configure Docker
run: gcloud auth configure-docker us-docker.pkg.dev
- name: Extract platform suffix
id: platform-suffix
run: |
SUFFIX=$(echo "${{ matrix.platform }}" | tr '/' '-')
echo "suffix=${SUFFIX}" >> $GITHUB_OUTPUT
- name: Build and push
uses: docker/build-push-action@v5
with:
context: .
file: ./lab/Dockerfile
platforms: ${{ matrix.platform }}
push: true
tags: |
"tag1"
build-args: |
BUILDKIT_INLINE_CACHE=1
GO_VERSION=1.24Additional information
Possible workarounds:
a) Use Identity Federation with Service Accounts. This is not something we want to do, since we want to start moving to the more secure Direct Federation. Reason it works with this is because the access_token that is generated using the Service Account has a TTL of 1 hour.
b) Instead of using auth_token, use the credentials.json, install gcloud binary and configure-docker instead. Example:
- uses: google-github-actions/auth@71f986410dfbc7added4569d411d040a91dc6935 # v2.1.8
if: ${{ steps.auth_with_service_account.outputs.access_token == '' }}
name: Auth with direct WIF
id: auth_with_direct_wif
with:
project_id: "<PROJECT_ID>"
workload_identity_provider: "projects/<PROJECT_ID>/locations/global/workloadIdentityPools/github/providers/github-provider"
- name: "Set up Cloud SDK"
uses: "google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a" # v2.1.4
with:
version: ">= 363.0.0"
- name: "Use gcloud CLI to configure docker"
shell: sh
run: "gcloud auth configure-docker ${{ inputs.registry }}"This way we still get a bigger TTL for the credentials.json file that gets generated when running the action.
Related issues: #432
Recent comment: #432 (comment)