main.go

package main

import (
	"fmt"
	"log"
	"os"
	"os/exec"
	"strings"

	"github.com/spf13/cobra"
)

type config struct {
	projectID             string
	githubRepositoryOwner string
	githubRepository      string
	poolName              string
	providerName          string
	showDeleted           bool
	unsafe                bool
	serviceAccount        string
}

func main() {
	cobra.EnableCommandSorting = false
	cfg := &config{
		poolName:     "github-actions-pool",
		providerName: "github-provider",
	}

	// ========================= Root =========================
	rootCmd := &cobra.Command{
		CompletionOptions: cobra.CompletionOptions{
			DisableDefaultCmd: true,
		},

		Use:   "gwif",
		Short: "Configure GitHub Actions OIDC Workload Identity Federation",
		Long: `This tool configures GitHub Actions to work without service account keys.
Workload Identity Federation generates temporary credentials for jobs by exchanging
OIDC tokens generated by GitHub, and associating them with service accounts permissions.
Requires elevated permissions in the target Google Cloud Project.
Required Roles: IAM Admin, Workload Identity Federation Admin.

Suggested Flow:
1. Create a pool
2. Create a provider
3. Authenticate a service account
4. Generate a YAML configuration
5. Add the YAML configuration in your GitHub Actions workflow
6. Remove any service account keys from GitHub secrets

Example:
gwif --project my-project pools create
gwif --project my-project providers create
gwif --project my-project auth
gwif --project my-project yaml
`,
	}

	rootCmd.PersistentFlags().StringVar(&cfg.projectID, "project", "", "Google Cloud project ID")

	// ========================= Pools =========================
	poolsCmd := &cobra.Command{
		Use:   "pools",
		Short: "Manage Workload Identity pools",
	}

	createPoolCmd := &cobra.Command{
		Use:   "create",
		Short: "Create a Workload Identity pool",
		RunE: func(cmd *cobra.Command, args []string) error {
			if err := AssistConfigForPoolCreate(cfg); err != nil {
				return err
			}
			if err := verifyActiveProject(cfg.projectID); err != nil {
				return err
			}
			return CreatePool(cfg)
		},
	}

	listPoolsCmd := &cobra.Command{
		Use:   "list",
		Short: "List Workload Identity pools",
		RunE: func(cmd *cobra.Command, args []string) error {
			if err := AssistConfigForRoot(cfg); err != nil {
				return err
			}

			pools, err := ListPools(cfg.projectID, cfg.showDeleted)
			if err != nil {
				return err
			}

			if len(pools) == 0 {
				if cfg.showDeleted {
					fmt.Println("No deleted workload identity pools found in project")
				} else {
					fmt.Println("No workload identity pools found in project")
				}
				return nil
			}

			for _, pool := range pools {
				if cfg.showDeleted {
					fmt.Printf("%s (deleted)\n", pool)
				} else {
					fmt.Println(pool)
				}
			}

			if cfg.showDeleted {
				fmt.Println()
				fmt.Println("Deleted pools are removed after a 30 day grace period.")
			}
			return nil
		},
	}

	deletePoolCmd := &cobra.Command{
		Use:   "delete",
		Short: "Delete a Workload Identity pool",
		RunE: func(cmd *cobra.Command, args []string) error {
			if err := AssistConfigForPoolDelete(cfg); err != nil {
				return err
			}

			return DeletePool(cfg)
		},
	}

	poolsCmd.PersistentFlags().StringVar(&cfg.poolName, "pool", "", "Workload Identity pool name")
	listPoolsCmd.Flags().BoolVar(&cfg.showDeleted, "deleted", false, "Show deleted pools")

	poolsCmd.AddCommand(createPoolCmd)
	poolsCmd.AddCommand(listPoolsCmd)
	poolsCmd.AddCommand(deletePoolCmd)
	rootCmd.AddCommand(poolsCmd)

	// ========================= Providers =========================
	providersCmd := &cobra.Command{
		Use:   "providers",
		Short: "Manage Workload Identity providers",
	}

	createProviderCmd := &cobra.Command{
		Use:   "create",
		Short: "Create a Workload Identity provider",
		RunE: func(cmd *cobra.Command, args []string) error {
			if err := AssistConfigForProviderCreate(cfg); err != nil {
				return err
			}
			if err := verifyActiveProject(cfg.projectID); err != nil {
				return err
			}

			projectNumber, err := getProjectNumber(cfg.projectID)
			if err != nil {
				return err
			}

			githubRepositoryFullName := fmt.Sprintf("%s/%s", cfg.githubRepositoryOwner, cfg.githubRepository)
			return CreateProvider(cfg, projectNumber, githubRepositoryFullName)
		},
	}

	listProvidersCmd := &cobra.Command{
		Use:   "list",
		Short: "List Workload Identity providers",
		RunE: func(cmd *cobra.Command, args []string) error {
			if err := AssistConfigForProviderSubcommand(cfg); err != nil {
				return err
			}
			if err := verifyActiveProject(cfg.projectID); err != nil {
				return err
			}
			providers, err := ListProviders(cfg.projectID, cfg.poolName, cfg.showDeleted)
			if err != nil {
				return err
			}

			if len(providers) == 0 {
				if cfg.showDeleted {
					fmt.Printf("No deleted workload identity providers found in pool %s\n", cfg.poolName)
				} else {
					fmt.Printf("No workload identity providers found in pool %s\n", cfg.poolName)
				}
				return nil
			}

			for _, provider := range providers {
				if cfg.showDeleted {
					fmt.Printf("%s (deleted)\n", provider)
				} else {
					fmt.Println(provider)
				}
			}
			if cfg.showDeleted {
				fmt.Println()
				fmt.Println("Deleted providers are removed after a 30 day grace period.")
			}
			return nil
		},
	}

	deleteProviderCmd := &cobra.Command{
		Use:   "delete",
		Short: "Delete a Workload Identity provider",
		RunE: func(cmd *cobra.Command, args []string) error {
			if err := AssistConfigForProviderDelete(cfg); err != nil {
				return err
			}
			if err := verifyActiveProject(cfg.projectID); err != nil {
				return err
			}
			return DeleteProvider(cfg)
		},
	}

	restoreProviderCmd := &cobra.Command{
		Use:   "restore",
		Short: "Restore a deleted Workload Identity provider",
		RunE: func(cmd *cobra.Command, args []string) error {
			if err := AssistConfigForProviderRestore(cfg); err != nil {
				return err
			}
			if err := verifyActiveProject(cfg.projectID); err != nil {
				return err
			}
			return RestoreProvider(cfg)
		},
	}
	providersCmd.PersistentFlags().StringVar(&cfg.poolName, "pool", "", "Workload Identity pool name")

	createProviderCmd.Flags().BoolVar(&cfg.unsafe, "unsafe", false, "Allow unsafe configurations (allows repository name condition to not be enforced in the provider)")
	createProviderCmd.Flags().StringVar(&cfg.providerName, "provider", "", "Workload Identity provider name")
	createProviderCmd.Flags().StringVar(&cfg.githubRepositoryOwner, "owner", "", "GitHub repository owner (case sensitive)")
	createProviderCmd.Flags().StringVar(&cfg.githubRepository, "repo", "", "GitHub repository name (case sensitive)")

	listProvidersCmd.Flags().BoolVar(&cfg.showDeleted, "deleted", false, "Show deleted providers")
	deleteProviderCmd.Flags().StringVar(&cfg.providerName, "provider", "", "Workload Identity provider name")
	restoreProviderCmd.Flags().StringVar(&cfg.providerName, "provider", "", "Workload Identity provider name")

	providersCmd.AddCommand(createProviderCmd)
	providersCmd.AddCommand(listProvidersCmd)
	providersCmd.AddCommand(deleteProviderCmd)
	providersCmd.AddCommand(restoreProviderCmd)
	rootCmd.AddCommand(providersCmd)

	// ========================= Auth =========================
	authCmd := &cobra.Command{
		Use:   "auth",
		Short: "Configure service account authentication",
		RunE: func(cmd *cobra.Command, args []string) error {
			if err := AssistConfigForAuth(cfg); err != nil {
				return err
			}
			if err := verifyActiveProject(cfg.projectID); err != nil {
				return err
			}

			projectNumber, err := getProjectNumber(cfg.projectID)
			if err != nil {
				return err
			}

			if err := AuthServiceAccount(cfg, projectNumber); err != nil {
				return err
			}

			fmt.Println()
			fmt.Println("YAML configuration:")
			DumpYAML(cfg, projectNumber)
			return nil
		},
	}
	authCmd.Flags().StringVar(&cfg.serviceAccount, "service-account", "", "Service account email address")
	authCmd.Flags().StringVar(&cfg.poolName, "pool", "", "Workload Identity pool name")
	authCmd.Flags().StringVar(&cfg.providerName, "provider", "", "Workload Identity provider name")

	rootCmd.AddCommand(authCmd)

	// ========================= YAML =========================
	yamlCmd := &cobra.Command{
		Use:   "yaml",
		Short: "Generate GitHub Actions YAML configuration",
		RunE: func(cmd *cobra.Command, args []string) error {
			if err := AssistConfigForYaml(cfg); err != nil {
				return err
			}

			projectNumber, err := getProjectNumber(cfg.projectID)
			if err != nil {
				return err
			}

			DumpYAML(cfg, projectNumber)
			return nil
		},
	}

	yamlCmd.Flags().StringVar(&cfg.poolName, "pool", "", "Workload Identity pool name")
	yamlCmd.Flags().StringVar(&cfg.providerName, "provider", "", "Workload Identity provider name")
	yamlCmd.Flags().StringVar(&cfg.serviceAccount, "service-account", "", "Service account email address")
	rootCmd.AddCommand(yamlCmd)

	if err := rootCmd.Execute(); err != nil {
		log.Println(err)
		os.Exit(1)
	}
}

func verifyActiveProject(projectID string) error {
	cmd := exec.Command("gcloud", "config", "get-value", "project")
	output, err := cmd.Output()
	if err != nil {
		return fmt.Errorf("failed to get current project: %v", err)
	}

	currentProject := strings.TrimSpace(string(output))
	if currentProject != projectID {
		return fmt.Errorf("gcloud is not currently configured to %s", projectID)
	}
	return nil
}

func getProjectNumber(projectID string) (string, error) {
	cmd := exec.Command("gcloud", "projects", "describe", projectID, "--format=value(projectNumber)")
	output, err := cmd.Output()
	if err != nil {
		return "", fmt.Errorf("failed to get project number: %v", err)
	}
	return strings.TrimSpace(string(output)), nil
}