Hi everyone,
We’ve hit a regression introduced in v1.5.0 of the gcp-workload-identity-federation-buildkite-plugin( GitHub - buildkite-plugins/gcp-workload-identity-federation-buildkite-plugin: 💨 Assume a Google Cloud service account using workload identity federation · GitHub ) and have raised a fix PR that’s been waiting for review.
The problem:
v1.5.0 changed the default hook from pre-command to environment (via #19 ( Change to env hook by nsuma8989 · Pull Request #19 · buildkite-plugins/gcp-workload-identity-federation-buildkite-plugin · GitHub )). This causes the plugin to overwrite GOOGLE_APPLICATION_CREDENTIALS before the checkout step runs — replacing the node’s own GCP credentials with the pipeline’s WIF service account, which typically doesn’t have access to checkout secrets (e.g. SSH keys in Secret Manager). Repository cloning then fails.The pre-command default was intentional per the original design in #27( feat: add functionality to run plugin in either environment or pre-command hook by derektamsen · Pull Request #27 · buildkite-plugins/gcp-workload-identity-federation-buildkite-plugin · GitHub ).
The fix:
We’ve raised PR #37 ( fix: revert default hook to pre-command to avoid breaking checkout by rajat2911 · Pull Request #37 · buildkite-plugins/gcp-workload-identity-federation-buildkite-plugin · GitHub ) which restores pre-command as the default, making environment an explicit opt-in via hook: environment.
Would love a review from any maintainers. Happy to iterate on the approach if needed.
Thanks!
