[Tracking] CI: Go Test auth step broken on main — BigQuery CI environment has no secrets configured

[will-sargent-dbtlabs]

No code change — Issues are disabled on this repo, so this draft PR is standing in as the tracking artifact for a CI/infra gap that needs someone with repo/environment admin access to resolve.

Summary

Every Test/Validate job in the Go Test workflow fails on main itself — this is not a fork-secrets-on-forked-PR edge case, it's baseline repo health. Confirmed via the workflow's own run history, not just by reading YAML.

Error

the GitHub Action workflow must specify exactly one of 'workload_identity_provider' or 'credentials_json'! ...
secrets are not passed to workflows triggered from forks, including Dependabot.

from the google-github-actions/auth step in .github/workflows/go_test.yaml (jobs "Validate bigquery latest/linux_amd64" and "Test/windows_amd64", and others gated on the BigQuery CI environment).

Root cause

google-github-actions/auth is configured to read secrets.gcloud_workload_identity_provider, scoped to the BigQuery CI GitHub environment. That environment currently has:

• 0 secrets
• 0 variables

(confirmed via gh api repos/dbt-labs/bigquery-adbc/environments/BigQuery%20CI/secrets and .../variables, both total_count: 0)

This isn't a recent regression

Full run history for the Go Test workflow on main:

Run	Created	Conclusion
26194163328	2026-05-20T22:41:08Z	failure
28981894084	2026-07-08T23:06:25Z	failure
30498445244	2026-07-29T23:06:35Z	failure
30788797549	2026-08-03T06:00:56Z	failure

The BigQuery CI environment was created at 2026-05-20T22:41:09Z — one second after the first of these runs. The auth step has failed on main on every run since the environment's creation; the WIF secret was apparently never populated.

What's needed

Someone with admin access to this repo needs to either:

1. Add a gcloud_workload_identity_provider secret (and/or credentials_json) to the BigQuery CI environment, pointing at a real GCP Workload Identity Federation provider, or
2. If there's no GCP project provisioned for this fork's CI yet, stand one up (possibly reusing whatever the upstream adbc-drivers/bigquery repo or another ADBC driver fork already has).

Not fixed directly here — the WIF provider value isn't something I have, and this touches shared CI credentials that should be coordinated with whoever set up the BigQuery CI environment on 2026-05-20 (cc @ajhlee-dbt @xuliangs @serramatutu — worth checking who owns this).

Related

Split out from #7, which fixes the separate (and unrelated) lint/staticcheck/RAT failures on main.