Merge pull request #46 from step-security/auto-cherry-pick

chore: Cherry-picked changes from upstream

Author: Raj-StepSecurity

.github/workflows/test.yml

@@ -34,7 +34,8 @@ defaults:
     shell: 'bash'
 
 permissions:
-  contents: read
+  contents: 'read'
+  statuses: 'write'
 
 jobs:
   unit:

README.md

@@ -93,6 +93,12 @@ For more usage options, see the [examples](docs/EXAMPLES.md).
 > SDK](https://github.com/firebase/firebase-admin-node/issues/1377). Use Service
 > Account Key JSON authentication instead.
 
+> [!WARNING]
+>
+> As of the time of this writing, the GitHub OIDC token expires in 5 minutes,
+> which means any derived credentials also expire in 5 minutes.
+
+
 The following inputs are for _authenticating_ to Google Cloud via Workload
 Identity Federation.
 

dist/main/index.js

@@ -1,6 +1,6 @@
 {
   "name": "@step-security/google-github-auth",
-  "version": "2.1.6",
+  "version": "2.1.10",
   "description": "Authenticate to Google Cloud using OIDC tokens or JSON service account keys.",
   "main": "dist/main/index.js",
   "scripts": {