I am trying to set up a deployment pipeline from GitHub action to GAE.
I start off by following this doc https://github.com/google-github-actions/auth#setup, using the Setting up Workload Identity Federation method.
It looks like everything seems to be working smoothly until the part where I either use gcloud app deploy or gcloud services list --enabled or any cmd needing authentication (In the "Build" step).
.github\workflows\app-engine.yml
name: Build using Cloud Build
on:
push:
branches:
- main
env:
PROJECT_ID: testinfra3
SERVICE_NAME: default
jobs:
setup-build-deploy:
name: Setup, Build, and Deploy
runs-on: ubuntu-latest
permissions:
contents: 'read'
id-token: 'write'
steps:
- name: Checkout
uses: actions/checkout@v3
- id: 'auth'
name: 'Authenticate to Google Cloud'
uses: 'google-github-actions/auth@v0'
with:
workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider'
service_account: 'my-service-account@my-project.iam.gserviceaccount.com'
- name: 'Set up Cloud SDK'
uses: google-github-actions/setup-gcloud@v0
- name: 'Build'
run: |-
gcloud app deploy
In the GitHub action deployment logs
I came across this solution Using ImpersonatedCredentials with python api for GCP PubSub SubscriberClient where he explained that some services and roles need to be bound and enabled. I tried it but still getting the same deployment error.
Here is a list of services enabled
Progress update 1
I restarted the whole process again and took @Juan and @John Hanley advice.
I found out that one of the mistake that i did was at step 8 the repo naming part instead of including the full path like username/repo_name i only use repo_name.
Now i have a new error message:
I guess it is due to permission issue to i try to set the service account to owner level but it is still not working!
Progress update 2
The screenshot above was a image from permission page under service my-github@testinfra6.iam.gserviceaccount.com that was why i was still getting the same error. What i had to do is add it from page IAM - Admin -> IAM -> Add, Ok adding permission works from there





