Jeremy Github Actions Gcp

GitHub Actions expert for Google Cloud and Vertex AI deployments with Workload Identity Federation (WIF), comprehensive security validation, and deployment best practices enforcement.

Overview

This plugin ensures secure, production-ready CI/CD pipelines for Vertex AI Agent Engine and Google Cloud services. It enforces Workload Identity Federation (WIF) instead of JSON service account keys, validates post-deployment health, and implements GitHub Actions best practices.

Installation

/plugin install jeremy-github-actions-gcp@claude-code-plugins-plus

Features

✅ Workload Identity Federation (WIF): Keyless authentication from GitHub to GCP ✅ Vertex AI Agent Engine: Automated deployment and validation pipelines ✅ Security Enforcement: No JSON keys, least privilege IAM, secrets scanning ✅ Post-Deployment Validation: Comprehensive health checks for deployed agents ✅ A2A Protocol Compliance: AgentCard validation and endpoint testing ✅ Automated Hooks: Pre-commit validation of workflow files ✅ Best Practices: OIDC permissions, security scanning, monitoring setup

Components

Agent

• gh-actions-gcp-expert: Expert in GitHub Actions for Vertex AI / GCP deployments

Skills (Auto-Activating)

• gh-actions-validator: Validates and enforces GitHub Actions best practices
• Tool Permissions: Read, Write, Edit, Grep, Glob, Bash
• Version: 1.0.0 (2026 schema compliant)

Hooks

• PreToolUse: Validates workflow files before writing/editing
• Triggers on: .github/workflows/.yml, .github/workflows/.yaml
• Runs: scripts/validate-workflow.sh

Quick Start

Natural Language Activation

Simply mention what you need:

"Create GitHub Actions workflow for Vertex AI deployment"
"Set up Workload Identity Federation for my project"
"Deploy ADK agent to Vertex AI Engine with CI/CD"
"Validate my GitHub Actions security"
"Automate Vertex AI agent deployment"

The skill auto-activates and enforces best practices.

Validation Rules Enforced

1. Workload Identity Federation (WIF) Mandatory

❌ NEVER ALLOWED - JSON Service Account Keys:

# ❌ FORBIDDEN
- uses: google-github-actions/auth@v2
  with:
    credentials_json: ${{ secrets.GCP_SA_KEY }}  # ❌ BLOCKS HOOK

✅ REQUIRED - WIF with OIDC:

# ✅ ENFORCED
permissions:
  id-token: write  # ✅ REQUIRED for WIF

- uses: google-github-actions/auth@v2
  with:
    workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
    service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }}

2. OIDC Permissions Required

# ✅ ENFORCED - Must have id-token: write
permissions:
  contents: read
  id-token: write  # REQUIRED for WIF

3. IAM Least Privilege

❌ Overly Permissive Roles Blocked:

• roles/owner - ❌ Blocked
• roles/editor - ❌ Blocked

✅ Least Privilege Roles Required:

• roles/run.admin - Cloud Run deployments
• roles/iam.serviceAccountUser - Service account impersonation
• roles/aiplatform.user - Vertex AI operations

4. Post-Deployment Validation

For Vertex AI deployments, validation is REQUIRED:

- name: Post-Deployment Validation
  run: |
    python scripts/validate-deployment.py \
      --agent-id=production-agent

Validation Checklist:

• ✅ Agent state is RUNNING
• ✅ Code Execution Sandbox enabled (7-14 day TTL)
• ✅ Memory Bank configured
• ✅ A2A Protocol compliant (AgentCard accessible)
• ✅ Model Armor enabled (prompt injection protection)
• ✅ VPC Service Controls configured
• ✅ Service account has minimal permissions
• ✅ Monitoring and alerting configured

5. Security Scanning

Recommended (warnings if missing):

- name: Scan for secrets
  uses: trufflesecurity/trufflehog@main

- name: Vulnerability scanning
  uses: aquasecurity/trivy-action@master

Workflow Templates

Template 1: Vertex AI Agent Engine Deployment

name: Deploy Vertex AI Agent

on:
  push:
    branches: [main]
    paths:
      - 'agent/**'

permissions:
  contents: read
  id-token: write

env:
  AGENT_ID: 'production-agent'
  REGION: 'us-central1'

jobs:
  deploy:
…

Template 2: WIF Setup (One-Time)

name: Setup Workload Identity Federation

on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  setup-wif:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Authenticate (one-time setup key)
        uses: google-github-actions/auth@v2
…

Template 3: Security Validation

name: Security Checks

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read
  security-events: write

jobs:
  security:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4
…