fix(secretstores.googlecloud): Handle public GCP service account keys correctly

plugins/secretstores/googlecloud/README.md

@@ -27,6 +27,12 @@ store usage.
   ## Path to the service account credentials file
   credentials_file = "./testdata/gdch.json"
 
+  ## OAuth2 scopes for the generated access token.
+  ## Defaults to cloud-platform for service-account credentials.
+  ## GDCH/STS users can ignore this option as only the audience
+  ## parameter is evaluated for those credential types.
+  # scopes = ["https://www.googleapis.com/auth/cloud-platform"]
+
   ## Audience sent to when retrieving an STS token.
   ## Currently only used for GDCH auth flow
   sts_audience = "https://{AUDIENCE_URL}"

plugins/secretstores/googlecloud/googlecloud.go

@@ -49,9 +49,18 @@ func (g *GoogleCloud) Init() error {
 	if err != nil {
 		return fmt.Errorf("unable to parse credentials file type: %w", err)
 	}
+
+	// Default to cloud-platform scope for standard public-GCP service-account JSON keys.
+	// This covers all GCP APIs; actual permissions are still gated by IAM roles.
+	// GDCH/STS users continue to rely exclusively on sts_audience (Scopes is ignored).
+	if len(g.Scopes) == 0 && credType == "service_account" {
+		g.Scopes = []string{"https://www.googleapis.com/auth/cloud-platform"}
+	}
+
 	saType := credentials.CredType(credType)
 
 	creds, err := credentials.NewCredentialsFromJSON(saType, serviceAccount, &credentials.DetectOptions{
+		Scopes:      g.Scopes,
 		STSAudience: g.STSAudience,
 		Client:      client,
 		Logger:      slog.NewLogger(g.Log),

plugins/secretstores/googlecloud/sample.conf

@@ -8,6 +8,12 @@
   ## Path to the service account credentials file
   credentials_file = "./testdata/gdch.json"
 
+  ## OAuth2 scopes for the generated access token.
+  ## Defaults to cloud-platform for service-account credentials.
+  ## GDCH/STS users can ignore this option as only the audience
+  ## parameter is evaluated for those credential types.
+  # scopes = ["https://www.googleapis.com/auth/cloud-platform"]
+
   ## Audience sent to when retrieving an STS token.
   ## Currently only used for GDCH auth flow
   sts_audience = "https://{AUDIENCE_URL}"