Repository navigation
Default auth_token expiration is 5 minutes instead of 10 minutes #474
Description
TL;DR
When using Direct Workload Identity Federation, the default expiration time for the auth_token is 5 minutes instead of 10 (which is what's been written in the documentation).
Expected behavior
The expectation would be for the token to be valid for 10 minutes as mentioned in the README.md file in the root.
Observed behavior
If I try to print the OIDC JWT token in GitHub Actions, I get:
{
"actor": "dsotirakis",
"aud": "https://github.com/org",
"base_ref": "main",
"event_name": "pull_request",
"exp": 1741684978,
"iat": 1741684678,
}The ttl for the token then is exp-iat= 300s = 5m.
If I run some steps that takes more than 5 minutes after I get authenticated, I get:
#30 ERROR: failed to push us-docker.pkg.dev[...]: failed to authorize: failed to fetch oauth token: unexpected status from GET request to https://us-docker.pkg.dev/v2/token?scope=repository%[...]%[...]%[...]%3Apull%2Cpush&service=us-docker.pkg.dev: 401 Unauthorized
which agrees with the token expiration.
Action YAML
build:
name: Build and publish mlops-lab
runs-on: ubuntu-latest
strategy:
matrix:
platform: [linux/amd64, linux/arm64]
steps:
- uses: actions/checkout@v4
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Login to Google Artifact Registry
uses: google-github-actions/auth@v2
with:
workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
service_account: ${{ secrets.SERVICE_ACCOUNT_EMAIL }}
- name: Set up gcloud CLI
uses: google-github-actions/setup-gcloud@v2
- name: Configure Docker
run: gcloud auth configure-docker us-docker.pkg.dev
- name: Extract platform suffix
id: platform-suffix
run: |
SUFFIX=$(echo "${{ matrix.platform }}" | tr '/' '-')
echo "suffix=${SUFFIX}" >> $GITHUB_OUTPUT
- name: Build and push
uses: docker/build-push-action@v5
with:
context: .
file: ./lab/Dockerfile
platforms: ${{ matrix.platform }}
push: true
tags: |
"tag1"
build-args: |
BUILDKIT_INLINE_CACHE=1
GO_VERSION=1.24Additional information
Possible workarounds:
a) Use Identity Federation with Service Accounts. This is not something we want to do, since we want to start moving to the more secure Direct Federation. Reason it works with this is because the access_token that is generated using the Service Account has a TTL of 1 hour.
b) Instead of using auth_token, use the credentials.json, install gcloud binary and configure-docker instead. Example:
- uses: google-github-actions/auth@71f986410dfbc7added4569d411d040a91dc6935 # v2.1.8
if: ${{ steps.auth_with_service_account.outputs.access_token == '' }}
name: Auth with direct WIF
id: auth_with_direct_wif
with:
project_id: "<PROJECT_ID>"
workload_identity_provider: "projects/<PROJECT_ID>/locations/global/workloadIdentityPools/github/providers/github-provider"
- name: "Set up Cloud SDK"
uses: "google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a" # v2.1.4
with:
version: ">= 363.0.0"
- name: "Use gcloud CLI to configure docker"
shell: sh
run: "gcloud auth configure-docker ${{ inputs.registry }}"This way we still get a bigger TTL for the credentials.json file that gets generated when running the action.
Related issues: #432
Recent comment: #432 (comment)
Activity
github-actions commentedon Mar 18, 2025
Hi there @dsotirakis 👋!
Thank you for opening an issue. Our team will triage this as soon as we can. Please take a moment to review the troubleshooting steps which lists common error messages and their resolution steps.
dsotirakis commentedon Apr 25, 2025
@sethvargo 👋
Sorry for the direct ping, I wonder if there are any actions that can be made for this issue? Thanks!
sethvargo commentedon Apr 25, 2025
Hi @dsotirakis - it looks like GitHub changed the value from 10min -> 5min, but we have no control over how the GitHub OIDC token is generated. There doesn't appear to be a way to request a longer
expon the token (at least not a documented one), and Google Cloud uses the provided OIDC token to determine the expiration of the federated token.The documentation says:
That is true and it's referred to
token_format: 'id_token', which is different than using the federated token directly.I'll document this in #483, but you may want to raise an FR to GitHub. We can't mint a token that exceeds the lifetime of the OIDC token.
javawizard commentedon Feb 19, 2026
Pardon my ignorance but: why not?
Is this something that could be changed GCP side? Tokens generated when impersonating service accounts can have longer lifespans; what's to stop workload identity federation from generating longer ones when using direct workload identity federation?
(If the answer is "that's going to take a hot minute to get the GCP workload identity pool team to prioritize such a change", that's totally understandable 😄 Mostly I'm curious if there's some technical limitation GCP-side that makes this impossible or if it's "simply" a matter of convincing the right stakeholders in GCP land that this should be made configurable as service account token lifespans are.)