neuron-technologies/neuron-web
3
0
Fork 0
Code Issues 2 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

ci: fall back to GCP_SA_KEY (Gitea doesn't inject OIDC request token)
Deploy marketing to Cloud Run / deploy (push) Failing after 1m2s
Details

Browse Source 
Gitea Actions doesn't currently inject ACTIONS_ID_TOKEN_REQUEST_TOKEN /
ACTIONS_ID_TOKEN_REQUEST_URL into job env, so google-github-actions/auth
can't mint a federated token. The WIF infrastructure stays in Terraform
so we can flip back once that gap closes; the JSON key in GCP_SA_KEY is
the working path today.
This commit is contained in:
Will Anderson
2026-05-02 12:58:06 -05:00
parent 00a63a202c
commit 654b977796
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy.yaml
+9 -5
View File
@@ -53,14 +53,18 @@ jobs:
ls -la "$DEST" | head -5 ls -la "$DEST" | head -5
echo "EL_HOME=$DEST" >> "$GITHUB_ENV" echo "EL_HOME=$DEST" >> "$GITHUB_ENV"
- name: Authenticate to GCP (Workload Identity) - name: Authenticate to GCP
id: auth id: auth
uses: google-github-actions/auth@v2 uses: google-github-actions/auth@v2
with: with:
workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER }} # Gitea Actions doesn't currently inject ACTIONS_ID_TOKEN_REQUEST_TOKEN,
service_account: ${{ secrets.GCP_DEPLOY_SA }} # so the WIF (workload_identity_provider + service_account) path fails
# If WIF doesn't work against this Gitea instance, swap in: # at runtime — google-github-actions/auth needs that env var to mint
# credentials_json: ${{ secrets.GCP_SA_KEY }} # a Gitea OIDC token. Fall back to the JSON SA key for now. The WIF
# provider + IAM bindings remain in Terraform so we can flip back
# once Gitea closes the gap (or once we wire act_runner into a
# custom OIDC issuer).
credentials_json: ${{ secrets.GCP_SA_KEY }}
- name: Set up gcloud SDK - name: Set up gcloud SDK
uses: google-github-actions/setup-gcloud@v2 uses: google-github-actions/setup-gcloud@v2