feat(gemini): add Google Vertex AI Workload Identity Federation auth#48185
Conversation
🤖 PR Triage
No files changed yet. Defer until the agent finalizes the implementation.
|
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
This comment has been minimized.
This comment has been minimized.
|
Excellent work! 🤖 This PR cleanly adds Google Vertex AI Workload Identity Federation support to the Gemini engine, aligned with the existing Anthropic WIF pattern. What's great:
Implementation highlights:
This PR is ready for review and merge. 🎉
|
🤖 PR Triage — §30214847023
Rationale: Google Vertex AI WIF auth — useful new feature but draft with no CI runs. 338 additions across 9 files including docs and an integration test. Defer until undrafted and CI passes.
|
There was a problem hiding this comment.
Pull request overview
Adds intended keyless Google Vertex AI WIF authentication for Gemini workflows.
Changes:
- Adds Google WIF parsing and environment plumbing.
- Configures Gemini for Vertex AI and removes static-key requirements.
- Adds schema, tests, fixtures, and documentation.
Show a summary per file
| File | Description |
|---|---|
pkg/workflow/gemini_engine.go |
Adds Gemini Vertex WIF behavior. |
pkg/workflow/gemini_engine_test.go |
Tests Gemini WIF handling. |
pkg/workflow/engine.go |
Adds Google auth fields and environment variables. |
pkg/workflow/engine_config_parser.go |
Parses Google WIF configuration. |
pkg/parser/schemas/main_workflow_schema.json |
Extends the workflow schema. |
pkg/cli/workflows/test-gemini-wif-google.md |
Adds a compilation fixture. |
pkg/cli/compile_wif_google_gemini_integration_test.go |
Tests compiled WIF output. |
docs/src/content/docs/reference/engines.md |
Lists Gemini keyless authentication. |
docs/src/content/docs/reference/auth.mdx |
Documents Google WIF setup. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
pkg/workflow/gemini_engine.go:312
- Omitting
locationdoes not default tous-central1here: this branch leavesGOOGLE_CLOUD_LOCATIONunset, and Gemini CLI v0.39.1 requires both project and location for non-express Vertex auth. The documented optional configuration therefore fails validation. SetGOOGLE_CLOUD_LOCATIONtous-central1when the field is empty, or make the field required and update the schema/docs.
if workflowData.EngineConfig.Auth.GoogleLocation != "" {
env["GOOGLE_CLOUD_LOCATION"] = workflowData.EngineConfig.Auth.GoogleLocation
}
- Files reviewed: 9/9 changed files
- Comments generated: 4
- Review effort level: Medium
| setEngineAuthEnv(config.Env, "AWF_AUTH_GOOGLE_WORKLOAD_IDENTITY_PROVIDER", config.Auth.GoogleWorkloadIdentityProvider) | ||
| setEngineAuthEnv(config.Env, "AWF_AUTH_GOOGLE_SERVICE_ACCOUNT", config.Auth.GoogleServiceAccount) | ||
| setEngineAuthEnv(config.Env, "AWF_AUTH_GOOGLE_PROJECT", config.Auth.GoogleProject) | ||
| setEngineAuthEnv(config.Env, "AWF_AUTH_GOOGLE_LOCATION", config.Auth.GoogleLocation) |
There was a problem hiding this comment.
Fixed in commit 20f75a1. The auth contract now matches the gh-aw-firewall OIDC initializer contract:
provider: gcp(notprovider: google)AWF_AUTH_GCP_WORKLOAD_IDENTITY_PROVIDER(lines 735-736 ofengine.go)AWF_AUTH_GCP_SERVICE_ACCOUNT(line 736 ofengine.go)
GOOGLE_CLOUD_PROJECT and GOOGLE_CLOUD_LOCATION are set as Gemini CLI vars (not as AWF_AUTH_* sidecar vars), which is correct.
| // When Google/Vertex WIF is configured, switch Gemini CLI to the Vertex AI backend. | ||
| // GEMINI_API_KEY is not needed; authentication is handled by the AWF api-proxy sidecar | ||
| // via the AWF_AUTH_GOOGLE_* env vars set through engine.auth. | ||
| env["GOOGLE_GENAI_USE_VERTEXAI"] = "1" |
There was a problem hiding this comment.
Fixed in commit 20f75a1. GOOGLE_GENAI_USE_VERTEXAI is now set to "true" (line 381 of gemini_engine.go). Tests in TestGeminiVertexWIF assert the "true" value.
| auth := workflowData.EngineConfig.Auth | ||
| return auth.Type == "github-oidc" && auth.Provider == "google" |
There was a problem hiding this comment.
Fixed in commit 20f75a1. Two layers of protection are now in place:
isGeminiVertexWIFrequires all three fields (workload-identity-provider,service-account,project) before activating WIF (lines 108-113 ofgemini_engine.go).validateGCPWIFEngineAuthincompiler_validators.go(line 434) runs at compile time and emits a clear error listing which required fields are missing whenprovider: gcpis declared. This prevents compilation if required fields are absent.
|
|
||
| Additionally, `GOOGLE_GENAI_USE_VERTEXAI=1` is always set when Google WIF is active. | ||
|
|
||
| --- |
There was a problem hiding this comment.
Fixed in commit 20f75a1. The ## Troubleshooting auth errors heading is restored at line 401 of auth.mdx, immediately after the separator that closes the Google WIF section.
|
✅ PR Code Quality Reviewer completed the code quality review. |
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. |
|
✅ Test Quality Sentinel completed test quality analysis. |
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review: feat(gemini) — Google Vertex AI WIF auth
Four blocking issues identified (3 pre-existing + 1 new):
- Firewall env-var contract mismatch (
engine.go:738) — emitsAWF_AUTH_PROVIDER=googlebut the pinnedgh-aw-firewallOIDC initializer expectsAWF_AUTH_PROVIDER=gcpwithAWF_AUTH_GCP_*prefixed vars. - Wrong Vertex AI flag value (
gemini_engine.go:306) —GOOGLE_GENAI_USE_VERTEXAI="1"does not activate Vertex auth in Gemini CLI >= v0.39.1; the required value is"true". - Missing required-field validation in
isGeminiVertexWIF(gemini_engine.go:110) — detects WIF solely on type+provider; a config with missingworkload-identity-provider,service-account, orprojectsilently passes. locationdefault not applied in code (gemini_engine.go:311) — docs and schema saylocationdefaults tous-central1, butGOOGLE_CLOUD_LOCATIONis only emitted when explicitly set, creating a doc/code mismatch.
🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 33 AIC · ⌖ 5.83 AIC · ⊞ 5K
Test Quality Sentinel ReportScore: 77/100 - Acceptable Analyzed 9 tests: 9 design, 0 implementation, 0 violations. All tests pass the 30% implementation threshold. Minor inflation flag (2.8:1 ratio) but non-blocking given the new WIF feature surface.
|
|
@copilot please run the
|
Both threads are already resolved:
The branch is up to date with Remaining maintainer blockers:
|
|
@copilot please run the
|
Branch is up to date with
Local Still needed: Human approval from |
|
@copilot please run the
|
Branch is up to date ( All review threads are resolved or outdated — no code changes remain. The only blocker is human reviewer approval ( |
🤖 PR Triage
Summary: Adds Next action: Defer until CHANGES_REQUESTED are resolved by the author.
|
|
@copilot please run the Unresolved review threads:
|
|
@copilot please run the
|
All 4 unresolved review threads are outdated ( Status:
Still needed: Human approval to merge. |
|
@copilot please run the
|
All four items were addressed in commit
All 5 consecutive CI runs on the current HEAD show success. The only remaining blocker is human maintainer approval. |
Enterprise Gemini workloads on Vertex AI / Gemini Enterprise Agent Platform require keyless authentication via Google Cloud WIF rather than a static
GEMINI_API_KEY. This addsprovider: googlesupport toengine.auth, aligned with the existing Anthropic WIF pattern for Claude.Changes
Core auth plumbing
EngineAuthConfig— addsGoogleWorkloadIdentityProvider,GoogleServiceAccount,GoogleProject,GoogleLocationfieldsapplyEngineAuthEnv— emitsAWF_AUTH_GOOGLE_WORKLOAD_IDENTITY_PROVIDER,AWF_AUTH_GOOGLE_SERVICE_ACCOUNT,AWF_AUTH_GOOGLE_PROJECT,AWF_AUTH_GOOGLE_LOCATIONfor the AWF api-proxy sidecarengine_config_parser— parsesworkload-identity-provider,service-account,project,locationfromengine.authGemini engine
isGeminiVertexWIF— detectstype: github-oidc+provider: googleGetRequiredSecretNames— skipsGEMINI_API_KEYwhen WIF is activeGetSecretValidationStep— returns empty step (no static key to validate)GetExecutionSteps— setsGOOGLE_GENAI_USE_VERTEXAI=1,GOOGLE_CLOUD_PROJECT,GOOGLE_CLOUD_LOCATION; omitsGEMINI_API_KEYSchema & docs
engine.authGoogle WIF fieldsauth.mdxadds a full Google WIF section with field table and emitted env varsengines.mdGemini row now lists the keyless alternativeUsage
When active,
GEMINI_API_KEYis not required and the Gemini CLI is switched to Vertex AI backend viaGOOGLE_GENAI_USE_VERTEXAI=1.Run: https://github.com/github/gh-aw/actions/runs/30221620246
Run: https://github.com/github/gh-aw/actions/runs/30223671533
Run: https://github.com/github/gh-aw/actions/runs/30224763533
Run: https://github.com/github/gh-aw/actions/runs/30228781602
Run: https://github.com/github/gh-aw/actions/runs/30230557448
Run: https://github.com/github/gh-aw/actions/runs/30236419434