google-github-actions / google-github-actions/get-secretmanager-secrets

Consider adding more docs about project id

Open
#327 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
TypeScript
Stars
198
Forks
40
Avg merge
21h 53m
Merged PRs (30d)
1

Description

TL;DR

Action should better integrate with auth action that did not detect project id.

Detailed design

Such setup:

- id: auth
  name: GCP OIDC
  uses: google-github-actions/auth@v2
  with:
    workload_identity_provider: 'projects/redacted/locations/global/workloadIdentityPools/github/providers/github'
- id: secrets
  name: GCP SM Read
  uses: google-github-actions/get-secretmanager-secrets@v2
  with:
    secrets: REDACTED

Will result in: failed to access secret "redacted/versions/latest": the caller does not have permission

Adding project_id: 'redacted' to the auth step resolves thi sissue completly.
It was nightmare to debug, because when using google-github-actions/setup-gcloud@v3 and then running gcloud secrets versions access latest --secret redacted --project=redacted worked fine.

I know that auth action has warning for the missing project ID, but it is too subtle IMO.
Additionally it is very easy to waste time debugging such access due to copy pasting CLI commands that may include project id anyway (like I did)

Additional information

I would love to see that this action somehow detects that I am using your auth action and verifies that project id is present or at least add such warning about missing project id there too.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the get-secretmanager-secrets action documentation and the example using google-github-actions/auth@v2. Document how project_id affects secret access, include the missing-project troubleshooting case, and clarify whether the action should warn when project information is absent. Done means a user can understand and resolve this permission error from the documentation.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, google-cloud, typescript
Domain
ci-cd, documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.