From 37ed6439ab317d3ae472200335d6b22609433073 Mon Sep 17 00:00:00 2001
From: rootkiller6788 <221446036+rootkiller6788@users.noreply.github.com>
Date: Mon, 21 Sep 2026 17:40:08 +0800
Subject: [PATCH 1/2] add gcp_audience input and pass it to the auth action

WIF setups that pin a custom audience on the provider currently can't work
here, because we request the default audience (the provider resource name)
when minting the OIDC token while the provider expects something else.

The auth action already has an 'audience' input for this, so this just
surfaces it. Leaving it unset keeps the old behaviour: auth falls back to
the workload identity provider when the value is empty.
---
 action.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/action.yml b/action.yml
index 35af14fe7..22a3a2f2e 100644
--- a/action.yml
+++ b/action.yml
@@ -30,6 +30,10 @@ inputs:
   gcp_workload_identity_provider:
     description: 'The Google Cloud Workload Identity Provider.'
     required: false
+  gcp_audience:
+    description: |-
+      The audience (aud) claim to request in the GitHub OIDC token. Only used when 'gcp_workload_identity_provider' is set. Defaults to the workload identity provider, which is what Google Cloud expects unless the provider itself is configured with a custom audience.
+    required: false
   gcp_token_format:
     description: 'The token format for authentication. Set to "access_token" to generate access tokens (requires service account), or set to empty string for direct WIF. Can be "access_token" or "id_token".'
     required: false
@@ -223,6 +227,7 @@ runs:
         project_id: '${{ inputs.gcp_project_id }}'
         workload_identity_provider: '${{ inputs.gcp_workload_identity_provider }}'
         service_account: '${{ inputs.gcp_service_account }}'
+        audience: '${{ inputs.gcp_audience }}'
         token_format: '${{ inputs.gcp_token_format }}'
         access_token_scopes: '${{ inputs.gcp_access_token_scopes }}'
 

From b09a9f2bf66cb1e29332c71a13b177e0a8d7db30 Mon Sep 17 00:00:00 2001
From: rootkiller6788 <221446036+rootkiller6788@users.noreply.github.com>
Date: Mon, 21 Sep 2026 17:40:51 +0800
Subject: [PATCH 2/2] warn when gcp_audience is set without a workload identity
 provider

It's easy to drop 'gcp_audience' into a workflow that authenticates with an
API key and then wonder why nothing changed - the audience only ends up in
the OIDC token, so without WIF there is nothing to apply it to. Added it to
the existing input checks next to the other WIF-specific ones.
---
 action.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/action.yml b/action.yml
index 22a3a2f2e..edb6add42 100644
--- a/action.yml
+++ b/action.yml
@@ -164,6 +164,12 @@ runs:
           fi
         fi
 
+        # The audience is only used for the OIDC token handed to the Workload
+        # Identity Provider, so it does nothing on its own.
+        if [[ -n "${INPUT_GCP_AUDIENCE}" && "${INPUT_GCP_WORKLOAD_IDENTITY_PROVIDER_PRESENT:-false}" != "true" ]]; then
+          warn "'gcp_audience' is only used with 'gcp_workload_identity_provider' and will be ignored."
+        fi
+
         # Validate Vertex AI API Key
         if [[ "${INPUT_GOOGLE_API_KEY_PRESENT:-false}" == "true" ]]; then
           if [[ "${INPUT_USE_VERTEX_AI:-false}" != "true" ]]; then
@@ -187,6 +193,7 @@ runs:
         INPUT_GCP_PROJECT_ID_PRESENT: "${{ inputs.gcp_project_id != '' }}"
         INPUT_GCP_SERVICE_ACCOUNT_PRESENT: "${{ inputs.gcp_service_account != '' }}"
         INPUT_GCP_TOKEN_FORMAT: '${{ inputs.gcp_token_format }}'
+        INPUT_GCP_AUDIENCE: '${{ inputs.gcp_audience }}'
         INPUT_USE_VERTEX_AI: '${{ inputs.use_vertex_ai }}'
         INPUT_USE_GEMINI_CODE_ASSIST: '${{ inputs.use_gemini_code_assist }}'