As per the error seems to be you have given invalid json file of service account which is not parsed by the Git actions workflow. As per this official github :
- (Optional) Create a Google Cloud Service Account. If you already have a Service Account, take note of the email address and skip this step :
# TODO: replace ${PROJECT_ID} with your value below. gcloud iam service-accounts create "my-service-account" \ --project "${PROJECT_ID}"
- Create a Service Account Key JSON for the Service Account.
# TODO: replace ${PROJECT_ID} with your value below. gcloud iam service-accounts keys create "key.json" \ --iam-account "my-service-account@${PROJECT_ID}.iam.gserviceaccount.com"
- Upload the contents of this file as a GitHub Actions Secret. Use the name of the GitHub Actios secret as the credentials_json value in the GitHub Actions YAML:
uses: 'google-github-actions/auth@v2' with: credentials_json: '${{ secrets.GOOGLE_CREDENTIALS }}' # Replace with the name of your GitHub Actions secret
Can you validate the above steps as per your yaml seems to be you need to give correct service account JSON file and also credentials json format need to be taken care.
---------- or else you can also achieve by using Workload Identity Federation through a Service Account by following this official github
Edit : Sinethemba Nontshintshi, achieved this by Changing the approach and used the Workload Identity Federation through a Service Account method to authenticate, by using this guide on how to set it up in GCP and in the YAML file it is passed as follows :
- name: Authenticate Google Cloud
uses: google-github-actions/auth@v2
with:
service_account: 'your-service account'
workload_identity_provider: 'your-workload-identity-provider'
Answer from Hemanth Kumar on Stack OverflowVideos
I needed to add:
jobs:
my_job:
# Need to add these 3 lines to add "id-token" with the intended permissions.
permissions:
contents: 'read'
id-token: 'write'
This is documented here: https://github.com/google-github-actions/auth#usage
For me, what I missing are
- Ensure the value for workload_identity_provider is the full Provider name, not the Pool name:
- projects/NUMBER/locations/global/workloadIdentityPools/POOL
+ projects/NUMBER/locations/global/workloadIdentityPools/POOL/providers/PROVIDER
- Need to have permission
permissions:
contents: 'read'
id-token: 'write'
Check out this https://github.com/google-github-actions/auth/blob/main/docs/TROUBLESHOOTING.md