As per the error seems to be you have given invalid json file of service account which is not parsed by the Git actions workflow. As per this official github :
- (Optional) Create a Google Cloud Service Account. If you already have a Service Account, take note of the email address and skip this step :
# TODO: replace ${PROJECT_ID} with your value below. gcloud iam service-accounts create "my-service-account" \ --project "${PROJECT_ID}"
- Create a Service Account Key JSON for the Service Account.
# TODO: replace ${PROJECT_ID} with your value below. gcloud iam service-accounts keys create "key.json" \ --iam-account "my-service-account@${PROJECT_ID}.iam.gserviceaccount.com"
- Upload the contents of this file as a GitHub Actions Secret. Use the name of the GitHub Actios secret as the credentials_json value in the GitHub Actions YAML:
uses: 'google-github-actions/auth@v2' with: credentials_json: '${{ secrets.GOOGLE_CREDENTIALS }}' # Replace with the name of your GitHub Actions secret
Can you validate the above steps as per your yaml seems to be you need to give correct service account JSON file and also credentials json format need to be taken care.
---------- or else you can also achieve by using Workload Identity Federation through a Service Account by following this official github
Edit : Sinethemba Nontshintshi, achieved this by Changing the approach and used the Workload Identity Federation through a Service Account method to authenticate, by using this guide on how to set it up in GCP and in the YAML file it is passed as follows :
- name: Authenticate Google Cloud
uses: google-github-actions/auth@v2
with:
service_account: 'your-service account'
workload_identity_provider: 'your-workload-identity-provider'
Answer from Hemanth Kumar on Stack OverflowVideos
Did any of you had any luck building an image with cache using Github Actions workflow?
I'm using this as main.yml
Currently I get this error:
ERROR: (gcloud.auth.docker-helper) There was a problem refreshing your current auth tokens: ('Unable to acquire impersonated credentials', '{\\n "error": {\\n "code": 403,\\n "message": "The caller does not have permission",\\n "status": "PERMISSION\_DENIED"\\n }\\n}\\n')
...
denied: Permission "artifactregistry.repositories.downloadArtifacts" denied on resource "projects/my-project/locations/us-central1/repositories/test" (or it may not exist)The service account currently have these permissions in IAM:
-
Artifact Registry Reader
-
Cloud Run Developer
-
Service Account User
-
Storage Admin
The Workload Identity Federation permissions in IAM:
-
API Keys Viewer
-
Artifact Registry Reader
-
Cloud Run Viewer
-
Firebase Authentication Admin
-
Firebase Hosting Admin
Any idea what could be the issue? or maybe an example workflow I can use?