I needed to add:
jobs:
my_job:
# Need to add these 3 lines to add "id-token" with the intended permissions.
permissions:
contents: 'read'
id-token: 'write'
This is documented here: https://github.com/google-github-actions/auth#usage
Answer from Brian C. on Stack OverflowI needed to add:
jobs:
my_job:
# Need to add these 3 lines to add "id-token" with the intended permissions.
permissions:
contents: 'read'
id-token: 'write'
This is documented here: https://github.com/google-github-actions/auth#usage
For me, what I missing are
- Ensure the value for workload_identity_provider is the full Provider name, not the Pool name:
- projects/NUMBER/locations/global/workloadIdentityPools/POOL
+ projects/NUMBER/locations/global/workloadIdentityPools/POOL/providers/PROVIDER
- Need to have permission
permissions:
contents: 'read'
id-token: 'write'
Check out this https://github.com/google-github-actions/auth/blob/main/docs/TROUBLESHOOTING.md
I fixed it by changing uses value to
uses: google-github-actions/setup-gcloud@v0
I have faced the similar error. When I was trying to call my local workflow from steps level. Apparently GitHub actions support local workflow call from jobs level. I could not call from inside steps.
name: Build and Deploy
on:
push:
branches: [dev]
permissions:
id-token: write
contents: read
jobs:
build-and-publish:
steps:
- name: Checkout
uses: actions/checkout@v2
- name: test local call from steps # this do not work
if: github.ref_name == 'dev'
uses: ./.github/workflows/deploy.yml # this is from steps level
with:
devops-bucket: bucket-name
role: iam role for the job
dev: # this worked well
if: github.ref_name == 'dev'
uses: ./.github/workflows/deploy.yml # this is jobs level
with:
devops-bucket: bucket-name
role: iam role for the job
For anyone trying to resolve this issue, make sure you have the IAM Service Account Credentials API API enabled, iamcredentials.googleapis.com in your GCP project first, which then enables the creation of short-lived tokens for service account impersonations.
I run into the same error yesterday. I made a typo in the step 8 of google-github-actions configuration and the new permission of the service account was wrong.
You can check it through the IAM page -> Service Accounts -> Permissions (tab).