I have a github action that is meant to publish an npm package to a private google cloud artifact registry. I've setup a workload identity pool, service account, and provider for this purpose, and successfully authed via the google-github-actions/auth action:
The steps underneath setting up gcloud all show the correct project, GOOGLE_APPLICATION_CREDENTIALS, etc, and I am able to run gcloud info and see accurate output. However, once I try to auth via npx google-artifactregistry-auth, I get an error that it can't find any credentials:
Here is my github action:
name: Publish package
on:
push:
branches: [ "main" ]
jobs:
publish:
runs-on: ubuntu-latest
permissions:
contents: "read"
id-token: "write"
steps:
- uses: actions/checkout@v3
- id: 'auth'
name: 'Authenticate to Google Cloud'
uses: 'google-github-actions/auth@v2'
with:
project_id: 'tandem-dnd'
workload_identity_provider: 'my-workload-pool'
service_account: 'my-service-account'
- name: 'Set up Cloud SDK'
uses: 'google-github-actions/setup-gcloud@v2'
- name: 'Install dependencies'
run: npm ci
- name: 'Gather gcloud cli info'
run: 'gcloud info'
- name: 'Publish package'
run: npm run artifactregistry-login && npm publish # this runs npx google-artifactregistry-auth
I've had actions just like this work for a different google cloud project, so I feel like I'm missing a step somewhere.
I tried explicitly exporting GOOGLE_APPLICATION_CREDENTIALS as part of that command. I also tried adding "echo GOOGLE_APPLICATION_CREDENTIALS" to the above command and it echoes the expected path to the json file.
You need to configure npm auth for Artifact Registry. Add this step before you publish:
- name: 'Configure npm for Artifact Registry'
run: gcloud artifacts print-settings npm --repository=<REPOSITORY_NAME> --location=<REGION> --project=tandem-dnd >> ~/.npmrc