ci: add GCP Workload Identity Federation for Vertex AI recording workflow#5276
Open
Artemon-line wants to merge 8 commits intollamastack:mainfrom
Open
ci: add GCP Workload Identity Federation for Vertex AI recording workflow#5276Artemon-line wants to merge 8 commits intollamastack:mainfrom
Artemon-line wants to merge 8 commits intollamastack:mainfrom
Conversation
…flow Add keyless OIDC-based authentication for the vertexai provider in the record-integration-tests workflow using google-github-actions/auth with Workload Identity Federation, replacing the need for static service account credentials. Changes: - Add id-token: write permission for OIDC token exchange - Add vertexai provider to the recording matrix (suite: responses) - Add google-github-actions/auth step (pinned SHA, v3) conditional on vertexai provider and non-fork PRs - Set VERTEX_AI_PROJECT from secret and VERTEX_AI_LOCATION to global - Add vertexai to default workflow_dispatch providers list Requires two repository secrets to be configured by maintainers: - GCP_WORKLOAD_IDENTITY_PROVIDER (WIF provider resource name) - VERTEX_AI_PROJECT (GCP project ID) Closes llamastack#5272 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Artemy <ahladenk@redhat.com>
meta-cla
bot
added
the
CLA Signed
Artemon-line
added a commit
to Artemon-line/llama-stack
that referenced
this pull request
Mar 27, 2026
Add vertexai to the CI responses test suite, enabling integration testing of the vertexai provider. Recordings will be auto-generated by the CI recording workflow after the WIF authentication PR (llamastack#5276) merges. - Add vertexai setup definition to tests/integration/suites.py - Add vertexai entry to CI matrix (ci_matrix.json) - Register vertexai model and provider in ci-tests distribution template - Add google-genai SDK patching to api_recorder.py for record/replay - Add vertexai-specific test skips for unsupported features (logprobs, service_tier, file search filters, incomplete_details length) - Add CI workflow env vars for vertexai in integration-tests.yml - Add VERTEX_AI env var passthrough in integration-tests.sh Closes llamastack#5102 Signed-off-by: Artemy Hladenko <ahladenk@redhat.com> Signed-off-by: Artemy <ahladenk@redhat.com>
4 tasks
Artemon-line
requested review from
ashwinb,
bbrowning,
cdoern,
ehhuang,
franciscojavierarceo,
leseb,
mattf and
raghotham
as code owners
cdoern
approved these changes
Mar 27, 2026
Collaborator
cdoern
left a comment
cdoern
left a comment
There was a problem hiding this comment.
lgtm. secrets exist now.
franciscojavierarceo
approved these changes
Mar 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
vertexaiprovider in therecord-integration-testsworkflow, replacing the need for static service account credentialsvertexaito the provider matrix and defaultworkflow_dispatchproviders listCloses #5272
Required setup by maintainers
Two repository secrets need to be configured:
GCP_WORKLOAD_IDENTITY_PROVIDER— full WIF provider resource name (projects/<id>/locations/global/workloadIdentityPools/<pool>/providers/<provider>)VERTEX_AI_PROJECT— GCP project IDVERTEX_AI_LOCATIONis hardcoded toglobal(not sensitive, required for Gemini models).Test plan
check-yamlpre-commit hook)act(act -n workflow_dispatch):vertexaiasrecord-providers-6) resolve correctlygoogle-github-actions/authaction (pinned SHA) is recognized and cloned for the vertexai jobworkflow_dispatchrun🤖 Generated with Claude Code