From 5a95614406f815c54863493356801b42838ad964 Mon Sep 17 00:00:00 2001
From: Brad Hilton <brad.hilton.nw@gmail.com>
Date: Thu, 17 Sep 2026 01:06:58 +0000
Subject: [PATCH] Use restricted workload identity for GPU image smoke launches

---
 .github/workflows/build-gpu-image.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/build-gpu-image.yml b/.github/workflows/build-gpu-image.yml
index f2c4ce117..1eff3a884 100644
--- a/.github/workflows/build-gpu-image.yml
+++ b/.github/workflows/build-gpu-image.yml
@@ -236,6 +236,7 @@ jobs:
             free -h || true
             ps -eo pid,ppid,stat,rss,comm,args | grep -E 'SkyPilot|sky|python' || true
             "${sky_cmd[@]}" api status || true
+            "${sky_cmd[@]}" logs --provision "${cluster}" || true
             if [ -f "${HOME}/.sky/api_server/server.log" ]; then
               tail -n 240 "${HOME}/.sky/api_server/server.log" || true
             fi
@@ -263,6 +264,7 @@ jobs:
               --infra "${SKY_INFRA}" \
               --gpus "${SMOKE_GPUS}" \
               --image-id "docker:${SMOKE_IMAGE_REPO}:${IMAGE_TAG}" \
+              --config kubernetes.remote_identity.cks-wb3=skypilot-workload \
               --config kubernetes.pod_config.spec.schedulerName=binpack-scheduler \
               --config kubernetes.pod_config.spec.activeDeadlineSeconds=604800 \
               "EXPECTED_ART_IMAGE_REVISION=${GITHUB_SHA} python -c '${smoke_code}'"