Describe connecting with read-only credentions on GCP #144

	name: Build

	on:
	push:
	branches: [main]

	permissions:
	id-token: write
	contents: read

	jobs:
	test-core:
	name: Test core
	runs-on: ubuntu-latest
	steps:
	- name: Check out code
	uses: actions/checkout@v4

	- name: Install Node.js
	uses: actions/setup-node@v3
	with:
	node-version: 21

	- uses: pnpm/action-setup@v2
	name: Install pnpm
	with:
	version: 8
	run_install: false

	- name: Install dependencies
	run: pnpm install
	working-directory: ./core

	- name: Run typescript
	run: pnpm tsc --noEmit
	working-directory: ./core

	- name: Run tests
	run: pnpm jest
	working-directory: ./core

	- name: Run ESLint
	run: pnpm lint
	working-directory: ./core

	build-local:
	name: Build local docker image
	runs-on: ubuntu-latest
	steps:
	- name: Check out code
	uses: actions/checkout@v4

	- name: Configure AWS credentials
	uses: aws-actions/configure-aws-credentials@v4
	with:
	role-to-assume: ${{ secrets.AWS_GH_ASSUME_ROLE }}
	role-session-name: github-actions-bemi-local
	aws-region: us-east-1

	- name: Login to Amazon ECR Public
	id: login-ecr-public
	uses: aws-actions/amazon-ecr-login@v2
	with:
	registry-type: public

	- name: Build, tag, and push image to Amazon ECR
	env:
	REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
	REGISTRY_ALIAS: bemi
	REPOSITORY: dev
	IMAGE_TAG: latest
	run: \|
	cd worker
	mv ../core ./core
	docker build -t $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:$IMAGE_TAG .
	docker push $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:$IMAGE_TAG

Provide feedback