Skip to content

setup_workload_identity.sh no longer works #444

Closed
#447
Closed
setup_workload_identity.sh no longer works#444
#447
Labels
area/authgithub_actionskind/bugSomething isn't workingkind/cicdstatus/route-upstreamIssues with Gemini CLI itself

Description

@anguillanneuf
anguillanneuf
opened on Jan 23, 2026

TL;DR

This convenience script to set up auth from GitHub Actions to Google Cloud worked last year in the November timeframe but no longer works now. It throws this error:

Expected behavior

No response

Observed behavior

No response

Action YAML

N/A

Log output

yarabaelish_835850@cloudshell:~ (festive-nova-476819)$ ./setup_workload_identity.sh --repo yarabaelish-demo/speckit --project festive-nova-476819
🚀 Starting Direct Workload Identity Federation setup
📦 Repository: yarabaelish-demo/speckit
☁️ Project: festive-nova-476819
🏊 Pool: github-68928269
🆔 Provider: gh-68928269

ℹ️  Verifying gcloud authentication...
✅ Authentication and project access verified
🚀 Step 1: Enabling required Google Cloud APIs
ERROR: (gcloud.services.enable) [yarabaelish.835850@gmail.com] does not have permission to access projects instance [festive-nova-476819] (or it may not exist): Bind permission denied for service: cloudcode-pa.googleapis.com
Service 'cloudcode-pa.googleapis.com' is an internal service; it requires explicit sharing with internal user/resource and cannot be used outside of its own organization.
Service cloudcode-pa.googleapis.com is not available to this consumer.
Help Token: AcxmRmLR4pJ9ewAYLFXjSJWgh6e-bbSkdvkBAh-WuV08oiTYVApPb29WE6h_q7JJAzbTaU4ApDjQ8hAR9q4_nwEMHxlqCpnVg9fMKT-D2ICeR8DB. This command is authenticated as yarabaelish.835850@gmail.com which is the active account specified by the [core/account] property
- '@type': type.googleapis.com/google.rpc.PreconditionFailure
  violations:
  - subject: '110002'
    type: googleapis.com
- '@type': type.googleapis.com/google.rpc.ErrorInfo
  domain: serviceusage.googleapis.com
  reason: AUTH_PERMISSION_DENIED

Additional information

No response

Activity

  1. gemini-cli commented on Jan 23, 2026

    @gemini-cli
    gemini-cliBot
    on Jan 23, 2026 – with gemini-cli
    Contributor

    🤖 Hi @anguillanneuf, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

  2. anguillanneuf commented on Jan 23, 2026

    @anguillanneuf
    anguillanneuf
    on Jan 23, 2026
    ContributorAuthor

    @gsehgal You might be able to shed light on the service changes to cloudcode-pa.googleapis.com. I don't think we can directly enable this service using gcloud.

  3. gemini-cli
    added
    kind/bugSomething isn't working
    status/route-upstreamIssues with Gemini CLI itself
    area/auth
    kind/cicd
    github_actions
    on Jan 23, 2026

  4. anguillanneuf commented on Jan 23, 2026

    @anguillanneuf
    anguillanneuf
    on Jan 23, 2026
    ContributorAuthor

    Another minor issue with the script is the lack of the ability to check for service account email character length. I hit Step 5 (as shown) and was informed that a service account had been created, even though it had not due to length issue (somehow the error did not show). This disrupted the flow.

    🚀 Step 5: Create and Configure Service Account for Gemini CLI
ℹ️  Creating Service Account: gemini-cli-4de8375a
Created service account [gemini-cli-4de8375a].
✅ Service Account created: gemini-cli-4de8375a@festive-nova-476819.iam.gserviceaccount.com
ℹ️  Granting 'Cloud AI Companion User' role to Service Account...
ERROR: Policy modification failed. For a binding with condition, run "gcloud alpha iam policies lint-condition" to identify issues in condition.
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Service account gemini-cli-4de8375a@festive-nova-476819.iam.gserviceaccount.com does not exist.

  5. gsehgal commented on Jan 24, 2026

    @gsehgal
    gsehgal
    on Jan 24, 2026
    Contributor

    Hi, Actually the code

    https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/code_assist/server.ts#L62

    uses 'https://cloudcode-pa.googleapis.com' which is internal api

    this probably needs to be changed to a public facing API geminicodeassist.googleapis.com (check codeassist-integration-guide docs)
    and also the setup script will need to change to include geminicodeassist.googleapis.com

  6. jerop
    added a parent issue on Jan 27, 2026
  7. spencer426
    linked a pull request that will close this issuefix(setup): Gracefully handle internal-only Cloud #447on Jan 28, 2026
  8. spencer426
    closed this as completedin #447on Jan 28, 2026
  9. kschaab
    added a commit that references this issue on Mar 19, 2026

    fix: remove unused service and redundant IAM bindings in workload ide…

    642deeb
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/authgithub_actionskind/bugSomething isn't workingkind/cicdstatus/route-upstreamIssues with Gemini CLI itself

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions