From a333abdde10a1df7324617e971aa68bd756d5ade Mon Sep 17 00:00:00 2001 From: Seth Vargo Date: Tue, 28 Apr 2020 11:39:25 -0400 Subject: [PATCH] Add clarity around service_account_email Fixes GH-95 --- .../get-secretmanager-secrets-it.yml | 1 - .github/workflows/setup-gcloud-it.yml | 24 ++++++++++++++++--- action.yml | 9 +++---- .../cloud-run/.github/workflows/cloud-run.yml | 3 +-- example-workflows/cloud-run/README.md | 2 -- .../gae/.github/workflows/app-engine.yml | 3 +-- example-workflows/gae/README.md | 1 - .../gce/.github/workflows/gce.yaml | 3 +-- example-workflows/gce/README.md | 2 -- .../gke/.github/workflows/gke.yml | 3 +-- example-workflows/gke/README.md | 2 -- setup-gcloud/README.md | 11 ++++----- setup-gcloud/action.yml | 9 +++---- 13 files changed, 40 insertions(+), 33 deletions(-) diff --git a/.github/workflows/get-secretmanager-secrets-it.yml b/.github/workflows/get-secretmanager-secrets-it.yml index 5c7476f2..140a0457 100644 --- a/.github/workflows/get-secretmanager-secrets-it.yml +++ b/.github/workflows/get-secretmanager-secrets-it.yml @@ -13,7 +13,6 @@ jobs: - uses: actions/checkout@v2 - uses: ./setup-gcloud with: - service_account_email: ${{ secrets.GET_SECRETMANAGER_SECRETS_SA_EMAIL }} service_account_key: ${{ secrets.GET_SECRETMANAGER_SECRETS_SA_KEY_B64 }} export_default_credentials: true - id: secrets diff --git a/.github/workflows/setup-gcloud-it.yml b/.github/workflows/setup-gcloud-it.yml index 6893f829..221ac02b 100644 --- a/.github/workflows/setup-gcloud-it.yml +++ b/.github/workflows/setup-gcloud-it.yml @@ -24,8 +24,7 @@ jobs: - name: setup-gcloud uses: ./setup-gcloud/ with: - version: '286.0.0' - service_account_email: ${{ secrets.SETUP_GCLOUD_IT_EMAIL }} + version: '290.0.1' service_account_key: ${{ secrets.SETUP_GCLOUD_IT_KEY }} - name: Integration Tests @@ -42,6 +41,26 @@ jobs: steps: - uses: actions/checkout@v2 + - name: setup-gcloud + uses: ./setup-gcloud/ + with: + version: 'latest' + service_account_key: ${{ secrets.SETUP_GCLOUD_IT_KEY }} + + - name: Integration Tests + shell: bash + run: ./setup-gcloud/tests/integration-tests.sh + + email: + name: setup-gcloud user-defined email + runs-on: ${{ matrix.operating-system }} + strategy: + fail-fast: false + matrix: + operating-system: [ubuntu-latest, windows-latest, macos-latest] + steps: + - uses: actions/checkout@v2 + - name: setup-gcloud uses: ./setup-gcloud/ with: @@ -67,7 +86,6 @@ jobs: uses: ./setup-gcloud/ with: version: 'latest' - service_account_email: ${{ secrets.SETUP_GCLOUD_IT_EMAIL }} service_account_key: ${{ secrets.SETUP_GCLOUD_IT_KEY }} export_default_credentials: true diff --git a/action.yml b/action.yml index d06fd9c9..8dceaf22 100644 --- a/action.yml +++ b/action.yml @@ -23,14 +23,15 @@ inputs: description: |- Version of the gcloud SDK to install. If unspecified or set to "latest", the latest available gcloud SDK version for the target platform will be - installed. Example: "286.0.0". + installed. Example: "290.0.1". default: latest required: false service_account_email: description: |- - Service account email address to use for authentication. This is usually - of the format @.iam.gserviceaccount.com. + Service account email address to use for authentication. This is required + for legacy .p12 keys but can be omitted for .json keys. This is usually of + the format @.iam.gserviceaccount.com. required: false service_account_key: @@ -38,7 +39,7 @@ inputs: Service account key to use for authentication. This should be the JSON formatted private key which can be exported from the Cloud Console. The value can be raw or base64-encoded. - required: true + required: false project_id: description: |- diff --git a/example-workflows/cloud-run/.github/workflows/cloud-run.yml b/example-workflows/cloud-run/.github/workflows/cloud-run.yml index cd983129..79bf1337 100644 --- a/example-workflows/cloud-run/.github/workflows/cloud-run.yml +++ b/example-workflows/cloud-run/.github/workflows/cloud-run.yml @@ -36,8 +36,7 @@ jobs: # Setup gcloud CLI - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master with: - version: '286.0.0' - service_account_email: ${{ secrets.RUN_SA_EMAIL }} + version: '290.0.1' service_account_key: ${{ secrets.RUN_SA_KEY }} project_id: ${{ secrets.RUN_PROJECT }} diff --git a/example-workflows/cloud-run/README.md b/example-workflows/cloud-run/README.md index f42b390a..8b076af5 100644 --- a/example-workflows/cloud-run/README.md +++ b/example-workflows/cloud-run/README.md @@ -70,8 +70,6 @@ For pushes to the `master` branch, this workflow will: - `RUN_PROJECT`: Google Cloud project ID - - `RUN_SA_EMAIL`: the email of the service account - - `RUN_SA_KEY`: the content of the service account JSON file ## Run the workflow diff --git a/example-workflows/gae/.github/workflows/app-engine.yml b/example-workflows/gae/.github/workflows/app-engine.yml index e0f9680e..bab2b9b5 100644 --- a/example-workflows/gae/.github/workflows/app-engine.yml +++ b/example-workflows/gae/.github/workflows/app-engine.yml @@ -31,9 +31,8 @@ jobs: # Setup and configure gcloud CLI - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master with: - version: '286.0.0' + version: '290.0.1' project_id: ${{ secrets.PROJECT_ID }} - service_account_email: ${{ secrets.SA_EMAIL }} service_account_key: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS}} # Deploy App to App Engine diff --git a/example-workflows/gae/README.md b/example-workflows/gae/README.md index c798c152..fd8e49dd 100644 --- a/example-workflows/gae/README.md +++ b/example-workflows/gae/README.md @@ -34,7 +34,6 @@ For pushes to the _default_ branch, `master`, the workflow will: 1. Fill in the [repository's secret][secrets]: * `PROJECT_ID` Your Project Id - * `SA_EMAIL` Service Account email * `GOOGLE_APPLICATION_CREDENTIALS` Service Account Key 1. Enable the [App Engine API and Cloud Build API.](https://console.cloud.google.com/flows/enableapi?apiid=appengine.googleapis.com,cloudbuild.googleapis.com&redirect=https://console.cloud.google.com&_ga=2.248833607.-1346582427.1578963531). diff --git a/example-workflows/gce/.github/workflows/gce.yaml b/example-workflows/gce/.github/workflows/gce.yaml index 0aa9e780..2b8ab852 100644 --- a/example-workflows/gce/.github/workflows/gce.yaml +++ b/example-workflows/gce/.github/workflows/gce.yaml @@ -36,8 +36,7 @@ jobs: # Setup gcloud CLI - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master with: - version: '286.0.0' - service_account_email: ${{ secrets.GCE_SA_EMAIL }} + version: '290.0.1' service_account_key: ${{ secrets.GCE_SA_KEY }} project_id: ${{ secrets.GCE_PROJECT }} diff --git a/example-workflows/gce/README.md b/example-workflows/gce/README.md index 2e899ef6..94d0d33c 100644 --- a/example-workflows/gce/README.md +++ b/example-workflows/gce/README.md @@ -64,8 +64,6 @@ For pushes to the `master` branch, this workflow will: - `GCE_PROJECT`: Google Cloud project ID - - `GCE_SA_EMAIL`: the email of the service account - - `GCE_SA_KEY`: the content of the service account JSON file 1. Update `.github/workflows/gce.yml` to match the values corresponding to your diff --git a/example-workflows/gke/.github/workflows/gke.yml b/example-workflows/gke/.github/workflows/gke.yml index ec43e903..fd020ecf 100644 --- a/example-workflows/gke/.github/workflows/gke.yml +++ b/example-workflows/gke/.github/workflows/gke.yml @@ -37,8 +37,7 @@ jobs: # Setup gcloud CLI - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master with: - version: '286.0.0' - service_account_email: ${{ secrets.GKE_SA_EMAIL }} + version: '290.0.1' service_account_key: ${{ secrets.GKE_SA_KEY }} project_id: ${{ secrets.GKE_PROJECT }} diff --git a/example-workflows/gke/README.md b/example-workflows/gke/README.md index 7479bdfd..97d844ee 100644 --- a/example-workflows/gke/README.md +++ b/example-workflows/gke/README.md @@ -64,8 +64,6 @@ For pushes to the `master` branch, this workflow will: - `GKE_PROJECT`: Google Cloud project ID - - `GKE_SA_EMAIL`: the email of the service account - - `GKE_SA_KEY`: the content of the service account JSON file 1. Update `.github/workflows/gce.yml` to match the values corresponding to your diff --git a/setup-gcloud/README.md b/setup-gcloud/README.md index 570522ba..c3be467f 100644 --- a/setup-gcloud/README.md +++ b/setup-gcloud/README.md @@ -30,8 +30,8 @@ It does the following: per-invocation basis using the `--project` flag. 1. If `service_account_key` is specified, authenticates the gcloud CLI tool - using the inputs: `service_account_email` and `service_account_key`. Please - see the [Service Account documentation][sa-iam-docs] for more information. + using the service account key. For legacy .p12 keys, you must also specify a + `service_account_email`. 1. If `export_default_credentials` is specified, exports the path to the credentials in the environment variable `GOOGLE_APPLICATION_CREDENTIALS` to @@ -56,9 +56,8 @@ steps: - uses: actions/checkout@v2 - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master with: - version: '285.0.0' + version: '290.0.1' project_id: ${{ secrets.GCP_PROJECT_ID }} - service_account_email: ${{ secrets.GCP_SA_EMAIL }} service_account_key: ${{ secrets.GCP_SA_KEY }} export_default_credentials: true - run: gcloud info @@ -66,9 +65,9 @@ steps: ## Inputs -* `version`: (Optional) The version of the gcloud to be installed. Example: `285.0.0`, Default: `latest` +* `version`: (Optional) The version of the gcloud to be installed. Example: `290.0.1`, Default: `latest` -* `service_account_email`: (Optional) The service account email which will be used for authentication. +* `service_account_email`: (Optional) Service account email address to use for authentication. This is required for legacy .p12 keys but can be omitted for .json keys. This is usually of the format `@.iam.gserviceaccount.com`. * `service_account_key`: (Optional) The service account key which will be used for authentication. This key should be [created](https://cloud.google.com/iam/docs/creating-managing-service-account-keys), encoded as a [Base64](https://en.wikipedia.org/wiki/Base64) string (eg. `cat my-key.json | base64` on macOS), and stored as a [secret](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets). diff --git a/setup-gcloud/action.yml b/setup-gcloud/action.yml index 24402c26..44ee73ca 100644 --- a/setup-gcloud/action.yml +++ b/setup-gcloud/action.yml @@ -23,14 +23,15 @@ inputs: description: |- Version of the gcloud SDK to install. If unspecified or set to "latest", the latest available gcloud SDK version for the target platform will be - installed. Example: "286.0.0". + installed. Example: "290.0.1". default: latest required: false service_account_email: description: |- - Service account email address to use for authentication. This is usually - of the format @.iam.gserviceaccount.com. + Service account email address to use for authentication. This is required + for legacy .p12 keys but can be omitted for .json keys. This is usually of + the format @.iam.gserviceaccount.com. required: false service_account_key: @@ -38,7 +39,7 @@ inputs: Service account key to use for authentication. This should be the JSON formatted private key which can be exported from the Cloud Console. The value can be raw or base64-encoded. - required: true + required: false project_id: description: |-