## Description
PRs from external forks have been failing CI because
`google-github-actions/auth` cannot complete OIDC auth: our GCP Workload
Identity Federation provider only trusts the base repository, so the
OIDC token issued for a fork-PR run (which carries the fork's
`repository` claim) is rejected. See [run
#25071797593](https://github.com/warpdotdev/warp/actions/runs/25071797593/job/73455200680?pr=9280)
for an example failure.
The auth is only needed by SSH integration tests, which use `gcloud
compute start-iap-tunnel` to reach a GCP-hosted Ubuntu VM. As a
short-term unblock, this skips the `auth` and `setup-gcloud` steps on
fork-PR runs and filters the SSH-dependent tests out of the test runs
(they all match `_ssh_` in their test names). All other tests continue
to run as before, and SSH integration coverage is unchanged on `master`,
`workflow_dispatch`, `workflow_call`, and same-repo PRs — those tests
still validate post-merge.
A more complete fix (e.g. a `workflow_run`-triggered job that runs SSH
tests in the base repo's context against the fork's SHA) is a possible
follow-up if we decide fork PRs need full SSH coverage.
## Testing
Validated via YAML parse. Will verify behavior on this PR's CI run
(same-repo PR — SSH tests should still run) and on a fork PR before
relying on it.
## Server API dependencies
N/A — CI-only change.
## Agent Mode
- [x] Warp Agent Mode - This PR was created via Warp's AI Agent Mode
David Stern
21cb7e56d1