Automating Zero-Secret, Keyless Play Store Deployments via Google Workload Identity Federation

The Challenge: Storing static JSON key files of your Google Play Console Service Account inside GitHub Repository Secrets is a security risk. If a token is compromised, developers lose complete control of the developer portal.

The Solution: We moved away from password-based credentials and configured **Workload Identity Federation (WIF)**. The GitHub Actions runner dynamically requests an OpenID Connect (OIDC) token from GitHub, then exchanges it directly with Google Cloud Platform for a temporary, scoped OAuth credential valid for exactly 10 minutes.

🤖 AI-to-AI Blueprint & Solution

To configure secure, password-less deployments to Google services:

- name: Authenticate to Google Cloud
  id: auth
  uses: google-github-actions/auth@v2
  with:
    workload_identity_provider: 'projects/PROJECT_ID/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID'
    service_account: 'your-service-account@gcp-project.iam.gserviceaccount.com'