ci: add GCP tests workflow for GitHub Actions

Mirrors the existing CircleCI gcp_test job so GCP tests run on GHA
alongside AWS, Azure, Terraform, Terragrunt, and Kubernetes. Auth uses
google-github-actions/auth with GCLOUD_SERVICE_KEY to match the
existing CircleCI credentials. GOOGLE_CLOUD_PROJECT, GOOGLE_COMPUTE_ZONE,
and GOOGLE_IDENTITY_EMAIL use the same names as the CircleCI context
for zero-rename migration.

The CircleCI job is left in place so both CIs can run in parallel
until this workflow is confirmed green.

Author: james00012

.github/workflows/gcp-tests.yml

@@ -0,0 +1,103 @@
+name: GCP Tests
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'modules/gcp/**'
+      - 'test/gcp/**'
+      - 'go.mod'
+      - 'go.sum'
+  pull_request:
+    paths:
+      - 'modules/gcp/**'
+      - 'test/gcp/**'
+      - 'go.mod'
+      - 'go.sum'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: GCP Tests
+    # Skip PRs from forks — repo secrets aren't exposed there, so auth would fail.
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+
+    env:
+      # GOOGLE_CLOUD_PROJECT is the env var that the GCP provider helper
+      # (gcp.GetGoogleProjectIDFromEnvVar) actually reads.
+      GOOGLE_CLOUD_PROJECT: ${{ vars.GOOGLE_CLOUD_PROJECT }}
+      # GOOGLE_COMPUTE_ZONE is consumed by the gcloud config step below.
+      GOOGLE_COMPUTE_ZONE: ${{ vars.GOOGLE_COMPUTE_ZONE }}
+      # GOOGLE_IDENTITY_EMAIL is required by the oslogin and static_token tests.
+      GOOGLE_IDENTITY_EMAIL: ${{ vars.GOOGLE_IDENTITY_EMAIL }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install mise
+        uses: jdx/mise-action@v3
+        with:
+          version: 2025.12.10
+          experimental: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Go module cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          credentials_json: ${{ secrets.GCLOUD_SERVICE_KEY }}
+
+      - name: Set up gcloud CLI
+        uses: google-github-actions/setup-gcloud@v2
+        with:
+          project_id: ${{ vars.GOOGLE_CLOUD_PROJECT }}
+
+      - name: Configure gcloud defaults
+        run: |
+          gcloud --quiet config set project "$GOOGLE_CLOUD_PROJECT"
+          gcloud --quiet config set compute/zone "$GOOGLE_COMPUTE_ZONE"
+
+      - name: Download Go modules
+        run: go mod download
+
+      - name: Build GCP module
+        run: go build ./modules/gcp/...
+
+      - name: Compile GCP module tests
+        run: go test -tags gcp -c -o /dev/null ./modules/gcp/...
+
+      - name: Compile GCP integration tests
+        run: go test -tags gcp -c -o /dev/null ./test/gcp/...
+
+      - name: Run GCP module tests
+        run: |
+          mkdir -p /tmp/logs
+          go test -v -count=1 -timeout 30m -tags gcp ./modules/gcp/... 2>&1 | tee /tmp/logs/gcp-module-tests.log
+
+      - name: Run GCP integration tests
+        run: |
+          go test -v -count=1 -timeout 45m -tags gcp ./test/gcp/... 2>&1 | tee /tmp/logs/gcp-integration-tests.log
+
+      - name: Upload test logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: gcp-test-logs
+          path: /tmp/logs/