Add temporary Firstrade secret access grant workflow

Author: Pigbibi

.github/workflows/grant-firstrade-telegram-secret-access.yml

@@ -0,0 +1,41 @@
+name: Grant Firstrade Telegram Secret Access
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  grant:
+    name: Grant Firstrade workflow Telegram secret access
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      GCP_PROJECT_ID: firstradequant
+      GCP_WORKLOAD_IDENTITY_PROVIDER: projects/1088907247379/locations/global/workloadIdentityPools/github-actions/providers/github-main
+      GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT: firstrade-platform-deploy@firstradequant.iam.gserviceaccount.com
+      TELEGRAM_TOKEN_SECRET_NAME: firstrade-telegram-token
+    steps:
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v3
+        with:
+          workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ env.GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT }}
+
+      - name: Set up gcloud
+        uses: google-github-actions/setup-gcloud@v3
+
+      - name: Grant and verify secret accessor
+        run: |
+          set -euo pipefail
+          gcloud secrets add-iam-policy-binding "${TELEGRAM_TOKEN_SECRET_NAME}" \
+            --project="${GCP_PROJECT_ID}" \
+            --member="serviceAccount:${GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT}" \
+            --role="roles/secretmanager.secretAccessor" \
+            --condition=None \
+            --quiet
+          gcloud secrets versions access latest \
+            --secret="${TELEGRAM_TOKEN_SECRET_NAME}" \
+            --project="${GCP_PROJECT_ID}" >/dev/null