Make WIF credential file readable inside the R2A container - #12
Make WIF credential file readable inside the R2A container#12andypotanin wants to merge 1 commit into
Conversation
google-github-actions/auth writes the credential file 0600. The R2A container runs as the non-root udx user, so the read-only bind mount fails with 'Configured GCP credential file could not be read'. Temporarily chmod 0644 for the duration of the container run and restore the original mode on exit.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| chmod "$credential_mode" "$GCP_CREDENTIALS_PATH" 2>/dev/null || true | ||
| } | ||
| trap restore_credential_mode EXIT | ||
| chmod 0644 "$GCP_CREDENTIALS_PATH" |
There was a problem hiding this comment.
🟡 Readable credentials abort deployment
An already world-readable credential file can belong to another account. The unconditional chmod fails, aborting deployment before the container starts.
Prompt for agents
In action.yml's Run Rabbit Automation Action step, avoid requiring ownership of a credential file that is already readable by the container. The current unconditional chmod 0644 fails for caller-provided, world-readable files owned by another account, which can occur on self-hosted runners or with externally mounted credentials. Inspect the effective target mode first and change permissions only when additional read access is required. Preserve the existing temporary-mode restoration behavior for files that are changed, and account for symbolic-link paths when reading and restoring the target mode.
Was this helpful? React with 👍 or 👎 to provide feedback.
| chmod "$credential_mode" "$GCP_CREDENTIALS_PATH" 2>/dev/null || true | ||
| } | ||
| trap restore_credential_mode EXIT | ||
| chmod 0644 "$GCP_CREDENTIALS_PATH" |
There was a problem hiding this comment.
🟡 Credential fix receives no release
Merging this behavior change without a new version makes Publish release skip publication. Versioned and v1 callers never receive the fix.
Prompt for agents
Prepare this action behavior change as the next patch release. Update package.json to the next semantic version and add the matching top entry to CHANGELOG.md with concise user-facing notes. Keep both values synchronized so make test passes and the production Publish release workflow detects the version change and creates the immutable release.
Was this helpful? React with 👍 or 👎 to provide feedback.
| chmod "$credential_mode" "$GCP_CREDENTIALS_PATH" 2>/dev/null || true | ||
| } | ||
| trap restore_credential_mode EXIT | ||
| chmod 0644 "$GCP_CREDENTIALS_PATH" |
There was a problem hiding this comment.
🟨 Cloud credentials exposed to runner users
chmod 0644 lets every local account read the active Google Cloud credential while the container runs. Shared-runner processes can copy it before restoration.
Was this helpful? React with 👍 or 👎 to provide feedback.
There was a problem hiding this comment.
Pull request overview
This PR addresses failures when running the action after google-github-actions/auth (Workload Identity) by ensuring the generated GOOGLE_APPLICATION_CREDENTIALS file can be read inside the R2A container (which runs as a non-root user).
Changes:
- Temporarily adjusts the GCP credentials file permissions to make the bind-mounted file readable inside the container.
- Adds cleanup logic intended to restore the original credential file mode after use.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # google-github-actions/auth writes the credential file 0600 and the | ||
| # R2A container runs as the non-root udx user, so the read-only bind | ||
| # mount is unreadable inside the container. Make it world-readable | ||
| # only while the container runs, then restore the original mode. | ||
| credential_mode="$(stat -c '%a' "$GCP_CREDENTIALS_PATH")" | ||
| restore_credential_mode() { | ||
| chmod "$credential_mode" "$GCP_CREDENTIALS_PATH" 2>/dev/null || true | ||
| } | ||
| trap restore_credential_mode EXIT | ||
| chmod 0644 "$GCP_CREDENTIALS_PATH" | ||
| gcp_mount=(-v "$GCP_CREDENTIALS_PATH:/tmp/gcp-credentials.json:ro" -e "GOOGLE_APPLICATION_CREDENTIALS=/tmp/gcp-credentials.json") |
|
Superseded by #13, which stages a readable copy of the credential in a private temp dir instead of chmod-ing the caller's file, and bumps the version so the fix actually ships. |
Problem
Calling the action after
google-github-actions/auth(workload identity) fails inside the R2A container with:google-github-actions/authwritesGOOGLE_APPLICATION_CREDENTIALSwith mode 0600. The R2A image runs as the non-rootudxuser, so the read-only bind mount at/tmp/gcp-credentials.jsonis unreadable inside the container.The private
udx/gh-workflowsreusable workflow works around this by chmod-ing the file beforedocker run; the public action did not, so any external caller following the README hits this.Fix
In the
Run Rabbit Automation Actionstep,chmod 0644the credential file for the duration of the container run and restore the original mode via an EXIT trap.Verification
Reproduced on
udx/www.wpcloud.iocallingudx/github-rabbit-action@v1.0.4directly:chmod 0644 "$GOOGLE_APPLICATION_CREDENTIALS": run 33249791898 passes, full production plan (14 services)