From a29e6c6364660e84a855410b0f9cd6511cf21d1d Mon Sep 17 00:00:00 2001 From: Andy Potanin Date: Sat, 29 Aug 2026 07:22:19 -0400 Subject: [PATCH] Make WIF credential file readable inside the R2A container google-github-actions/auth writes the credential file 0600. The R2A container runs as the non-root udx user, so the read-only bind mount fails with 'Configured GCP credential file could not be read'. Temporarily chmod 0644 for the duration of the container run and restore the original mode on exit. --- action.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/action.yml b/action.yml index b84f92a..57046cd 100644 --- a/action.yml +++ b/action.yml @@ -551,6 +551,16 @@ runs: echo "::error title=GCP credentials unavailable::Resolved credentials file is no longer readable." exit 1 fi + # google-github-actions/auth writes the credential file 0600 and the + # R2A container runs as the non-root udx user, so the read-only bind + # mount is unreadable inside the container. Make it world-readable + # only while the container runs, then restore the original mode. + credential_mode="$(stat -c '%a' "$GCP_CREDENTIALS_PATH")" + restore_credential_mode() { + chmod "$credential_mode" "$GCP_CREDENTIALS_PATH" 2>/dev/null || true + } + trap restore_credential_mode EXIT + chmod 0644 "$GCP_CREDENTIALS_PATH" gcp_mount=(-v "$GCP_CREDENTIALS_PATH:/tmp/gcp-credentials.json:ro" -e "GOOGLE_APPLICATION_CREDENTIALS=/tmp/gcp-credentials.json") fi