Answered by DazWilkin

I think file systems aren't shared between jobs (create_zip, google_cloud_services). You may want to prove this and consider moving the actions/download-artifact to google_cloud_services.

Working code

name: CI Workflow

on:
  push:
    branches:
      - main

env:
  PROJECT_ID: "flights-429420"
  BUCKET_NAME: "flights-cicd-bucket"

create_zip:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
        
      - name: Install zip
        run: sudo apt-get install zip

      - name: Create jobs.zip
        run: |
          cd app
          zip -r ../jobs.zip jobs

      - name: Upload zip file
        uses: actions/upload-artifact@v3
        with:
          name: jobs
          path: jobs.zip


  google_cloud_services:
    runs-on: ubuntu-latest
    needs: create_zip
    steps:

      - uses: actions/checkout@v3

      - name: Download zip file artifact
        uses: actions/download-artifact@v3
        with:
          name: jobs
          path: ./downloads
      
      - name: Authenticate with GCP using Service Account
        uses: 'google-github-actions/auth@v2'
        with:
          credentials_json: ${{ secrets.GCP_ACCOUNT_KEY }}
      
      - name: Setup GCP CLI
        uses: 'google-github-actions/setup-gcloud@v2'
        with:
          project_id: ${{ env.GCP_PROJECT_ID }}
          install_components: 'gsutil'
      
      - name: Create GCS bucket if not exists
        run: |
          if ! gsutil ls -b gs://${{ env.BUCKET_NAME }}/; then
            gsutil mb -l EU gs://${{ env.BUCKET_NAME }}/
          fi
      
      - name: Upload files to GCS
        run: |
          gsutil cp ./downloads/jobs.zip gs://${{ env.BUCKET_NAME }}/jobs.zip
          gsutil cp app/main.py gs://${{ env.BUCKET_NAME }}/main.py
          gcloud storage objects update gs://${{ env.BUCKET_NAME }}/main.py --content-type=application/octet-stream

The setup-gcloud action by default sets env variables that point toward the credentials file. Therefore you can mount this file inside your docker container and point the env variables towards the mounted file like this:

docker run --rm 
      --volume $GITHUB_WORKSPACE:/workspace
      --mount type=bind,source=$GOOGLE_APPLICATION_CREDENTIALS,target=/workspace/creds.json 
      --env GOOGLE_APPLICATION_CREDENTIALS=/workspace/creds.json
      --env CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE=/workspace/creds.json
      --env GOOGLE_GHA_CREDS_PATH=/workspace/creds.json
     

After I did this, the gcloud cli automatically detected the creds file and I could make authenticated calls. Hope this helps!