Export credentials into RUNNER_TEMP instead of GITHUB_WORKSPACE

.eslintrc.js

@@ -20,6 +20,7 @@ module.exports = {
   plugins: ['@typescript-eslint'],
   extends: [
     'eslint:recommended',
+    'plugin:@typescript-eslint/eslint-recommended',
     'plugin:@typescript-eslint/recommended',
     'plugin:prettier/recommended',
   ],

.prettierrc.js

@@ -18,7 +18,6 @@ module.exports = {
   arrowParens: 'always',
   bracketSpacing: true,
   endOfLine: 'auto',
-  jsxBracketSameLine: true,
   jsxSingleQuote: true,
   printWidth: 80,
   quoteProps: 'consistent',

README.md

@@ -28,7 +28,7 @@ Or integrate natively with other Google Cloud GitHub Actions:
 
 ## 📢 NOTICE
 
-**Previously this repository contained the code for ALL of the GCP GithHub Actions. Now each 
+**Previously this repository contained the code for ALL of the GCP GithHub Actions. Now each
 action has it's own repo and this repo is only for setup-gcloud**
 
 ### Use google-github-actions/setup-gcloud
@@ -77,7 +77,7 @@ steps:
 | `service_account_key`   | _optional_  | | The service account key which will be used for authentication credentials. This key should be [created](https://cloud.google.com/iam/docs/creating-managing-service-account-keys) and stored as a [secret](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets). It can be encoded as a [Base64](https://en.wikipedia.org/wiki/Base64) string or as JSON. |
 | `service_account_email` | _optional_  | | Service account email address to use for authentication. This is required for legacy .p12 keys but can be omitted for JSON keys. This is usually of the format `<name>@<project-id>.iam.gserviceaccount.com`. |
 | `export_default_credentials`| _optional_  |`false`| Exports the path to [Default Application Credentials][dac] as the environment variable `GOOGLE_APPLICATION_CREDENTIALS` to be available in later steps. Google Cloud services automatically use this environment variable to find credentials. |
-| `credentials_file_path`     | _optional_  | `GITHUB_WORKSPACE` | Only valid when `export_default_credentials` is `true`. Sets the path at which the credentials should be written. |
+| `credentials_file_path`     | _optional_  | (temporary file) | Only valid when `export_default_credentials` is `true`. Sets the path at which the credentials should be written. **WARNING:** If you write credentials outside of the GitHub Actions temporary path, they may be cached on self-hosted runners and exposed in future runs! See [Sharing Credentials](#sharing-credentials) for more information. |
 
 
 ## Example Workflows
@@ -93,6 +93,14 @@ code to [App Engine](https://cloud.google.com/appengine), a fully managed server
 
 * [Cloud Build](./example-workflows/cloud-build/README.md): An example workflow that uses GitHub Actions to build a container image with [Cloud Build](https://cloud.google.com/cloud-build).
 
+
+## Sharing Credentials
+
+If `export_default_credentials` is true, this GitHub Action will automatically export the credentials to be available in future steps in the job. By default, the credentials are exported to a temporary file that is automatically cleaned up when the job finishes. This file is available to all steps in the job.
+
+If you want to export credentials to be available to all jobs in a workflow, you can choose a custom `credentials_file_path` that resides in `GITHUB_WORKSPACE`. However, we do **NOT** recommend this approach, as this directory is not automatically cleaned up and can leak credentials files over time.
+
+
 ## Contributing
 
 See [CONTRIBUTING](CONTRIBUTING.md).