failed to authorize: failed to fetch anonymous token: unexpected status: 403 Forbidden

Contributing guidelines

• I've read the contributing guidelines and wholeheartedly agree

I've found a bug, and:

• The documentation does not mention anything about my problem
• There are no open or closed issues that are related to my problem

Description

I have two Google Artifact Registries:

• foo: for fetching base images from
• bar: for pushing images to

Now docker build works, if I replace foo by docker.io.
When however I run docker build using foo I get an error:

europe-west1-docker.pkg.dev/foo/ar/python:3.9-slim: failed to authorize: failed to fetch anonymous token: unexpected status: 403 Forbidden

github-deployer@bar.iam.gserviceaccount.com has Artifact Registry Reader permissions on europe-west1-docker.pkg.dev/foo/ar/python

So it seems like I cannot use the WIP access_token for accessing foo. But how would I then use WIP to login for foo?

Expected behaviour

Would be good if either it worked or at least the error message would state clearly why it doesn't work.

Actual behaviour

See above

Repository URL

No response

Workflow run URL

No response

YAML workflow

- id: auth
      uses: "google-github-actions/auth@v1"
      with:
        project_id: bar
        retries: 10
        service_account: 'github-deployer@bar.iam.gserviceaccount.com'
        token_format: access_token
        workload_identity_provider: projects/${{ inputs.project_number }}/locations/global/workloadIdentityPools/github/providers/oidc
    - uses: google-github-actions/setup-gcloud@v1
    - run: |
        gcloud auth configure-docker -q europe-west1-docker.pkg.dev
    - uses: docker/login-action@v3
      with:
        registry: europe-west1-docker.pkg.dev
        username: oauth2accesstoken
        password: "${{ steps.auth.outputs.access_token }}"

Workflow logs

No response

BuildKit logs

No response

Additional info

No response

Start with the workflow YAML, especially the google-github-actions/auth output and the docker/login-action step, and reproduce the build against both Artifact Registry repositories. Trace how the action passes the access token to Docker and compare the authentication and permission requirements for foo and bar. Done means the documented workflow authenticates successfully or reports the cause of the 403 clearly.