google-github-actions / google-github-actions/get-secretmanager-secrets
Consider adding more docs about project id
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 198
- Forks
- 40
- Avg merge
- 21h 53m
- Merged PRs (30d)
- 1
Description
TL;DR
Action should better integrate with auth action that did not detect project id.
Detailed design
Such setup:
- id: auth
name: GCP OIDC
uses: google-github-actions/auth@v2
with:
workload_identity_provider: 'projects/redacted/locations/global/workloadIdentityPools/github/providers/github'
- id: secrets
name: GCP SM Read
uses: google-github-actions/get-secretmanager-secrets@v2
with:
secrets: REDACTED
Will result in: failed to access secret "redacted/versions/latest": the caller does not have permission
Adding project_id: 'redacted' to the auth step resolves thi sissue completly.
It was nightmare to debug, because when using google-github-actions/setup-gcloud@v3 and then running gcloud secrets versions access latest --secret redacted --project=redacted worked fine.
I know that auth action has warning for the missing project ID, but it is too subtle IMO.
Additionally it is very easy to waste time debugging such access due to copy pasting CLI commands that may include project id anyway (like I did)
Additional information
I would love to see that this action somehow detects that I am using your auth action and verifies that project id is present or at least add such warning about missing project id there too.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the get-secretmanager-secrets action documentation and the example using google-github-actions/auth@v2. Document how project_id affects secret access, include the missing-project troubleshooting case, and clarify whether the action should warn when project information is absent. Done means a user can understand and resolve this permission error from the documentation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, google-cloud, typescript
- Domain
- ci-cd, documentation
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100