From 5276b57c4de1f1f995ab723f63cd8a056082d1fc Mon Sep 17 00:00:00 2001
From: Conrad Kramer <conrad@conradkramer.com>
Date: Sun, 7 Jun 2026 13:54:02 -0700
Subject: [PATCH] Fix WIF provider groups mapping

---
 infra/identity/google.tf    | 3 +--
 infra/identity/variables.tf | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/infra/identity/google.tf b/infra/identity/google.tf
index 7df00e8..8f20ea0 100644
--- a/infra/identity/google.tf
+++ b/infra/identity/google.tf
@@ -19,7 +19,7 @@ locals {
 
   google_runner_wif_group_members = var.google_wif_runner_group != "" ? (
     toset([
-      "principalSet://iam.googleapis.com/projects/${var.google_project_number}/locations/global/workloadIdentityPools/${var.google_wif_pool_id}/attribute.burrow_groups/${var.google_wif_runner_group}"
+      "principalSet://iam.googleapis.com/projects/${var.google_project_number}/locations/global/workloadIdentityPools/${var.google_wif_pool_id}/group/${var.google_wif_runner_group}"
     ])
     ) : (
     toset([])
@@ -142,7 +142,6 @@ resource "google_iam_workload_identity_pool_provider" "forgejo_runners" {
     "attribute.burrow_subject"   = "assertion.sub"
     "attribute.burrow_username"  = "assertion.preferred_username"
     "attribute.burrow_email"     = "assertion.email"
-    "attribute.burrow_groups"    = "assertion.groups"
     "attribute.burrow_client_id" = "assertion.azp"
   }
 
diff --git a/infra/identity/variables.tf b/infra/identity/variables.tf
index c88b52a..53889b6 100644
--- a/infra/identity/variables.tf
+++ b/infra/identity/variables.tf
@@ -177,7 +177,7 @@ variable "google_wif_allowed_audiences" {
 }
 
 variable "google_wif_runner_group" {
-  description = "Mapped Authentik group allowed to assume the runner service account. Leave empty for machine-to-machine client credentials."
+  description = "Google groups principal allowed to assume the runner service account. Leave empty for machine-to-machine client credentials."
   type        = string
   default     = ""
 }