From af1208eaa3d4f1e938e18eac11b47d3f35f022d9 Mon Sep 17 00:00:00 2001 From: Mansimran Singh Date: Wed, 19 Aug 2026 13:46:32 -0400 Subject: [PATCH] Route an androidpublisher-scoped token into get-next-version-code.sh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #685's access_token_scopes fix turned out to be a no-op — confirmed against google-github-actions/auth's docs: that setting only affects the action's own `access_token` *output*, which is only generated when `token_format: access_token` is set. Without it, get-next-version-code.sh's `gcloud auth print-access-token` call reads the ADC credentials file instead and mints its own token independent of that setting — and `gcloud auth print-access-token` has no --scopes flag to force it either, confirmed against the gcloud CLI reference. Fix: set token_format: access_token on the auth step so it actually generates a scoped access_token output, and thread that into the script via $ACCESS_TOKEN instead of shelling out to gcloud. Also made the script print the actual Play API error body on edit-creation failure instead of a generic message, so the next failure (if any) is diagnosable from the workflow log alone. Related to #626. --- .github/workflows/pre-release-upload.yml | 4 ++++ .github/workflows/ps-release.yml | 4 ++++ scripts/get-next-version-code.sh | 24 +++++++++++++++--------- 3 files changed, 23 insertions(+), 9 deletions(-) diff --git a/.github/workflows/pre-release-upload.yml b/.github/workflows/pre-release-upload.yml index df8b2684..c43ee296 100644 --- a/.github/workflows/pre-release-upload.yml +++ b/.github/workflows/pre-release-upload.yml @@ -33,13 +33,17 @@ jobs: run: echo $GOOGLE_SERVICES_JSON_B64 | base64 -d > app/google-services.json - name: Authenticate to Google Play + id: play_auth uses: google-github-actions/auth@v2 with: credentials_json: ${{ secrets.PLAY_STORE_CREDENTIALS }} + token_format: access_token access_token_scopes: https://www.googleapis.com/auth/androidpublisher - name: Compute next versionCode id: version_code + env: + ACCESS_TOKEN: ${{ steps.play_auth.outputs.access_token }} run: | value=$(./scripts/get-next-version-code.sh com.willowtree.vocable) echo "value=$value" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/ps-release.yml b/.github/workflows/ps-release.yml index 826ce9c1..521db8ae 100644 --- a/.github/workflows/ps-release.yml +++ b/.github/workflows/ps-release.yml @@ -41,13 +41,17 @@ jobs: run: echo $ENCODED_RELEASE_KEYSTORE | base64 -d > keystore - name: Authenticate to Google Play + id: play_auth uses: google-github-actions/auth@v2 with: credentials_json: ${{ secrets.PLAY_STORE_CREDENTIALS }} + token_format: access_token access_token_scopes: https://www.googleapis.com/auth/androidpublisher - name: Compute next versionCode id: version_code + env: + ACCESS_TOKEN: ${{ steps.play_auth.outputs.access_token }} run: | value=$(./scripts/get-next-version-code.sh com.willowtree.vocable) echo "value=$value" >> "$GITHUB_OUTPUT" diff --git a/scripts/get-next-version-code.sh b/scripts/get-next-version-code.sh index a0631f2a..cd9622dd 100755 --- a/scripts/get-next-version-code.sh +++ b/scripts/get-next-version-code.sh @@ -11,25 +11,31 @@ # a versionCode <= one already used on any track. Querying Play directly for # ground truth removes the dependency on run history entirely. # -# Requires: an active `gcloud` auth session for a service account with access -# to the Play Developer API for this app (see google-github-actions/auth in -# the calling workflow), and `curl`/`jq` on PATH. +# Requires an OAuth access token scoped to +# https://www.googleapis.com/auth/androidpublisher in $ACCESS_TOKEN — plain +# `gcloud auth print-access-token` mints one scoped to cloud-platform instead, +# which the Android Publisher API rejects, so the calling workflow must set +# `token_format: access_token` + `access_token_scopes` on +# google-github-actions/auth and pass its `access_token` output through +# rather than relying on the ADC credentials file. Also requires `curl`/`jq` +# on PATH. # -# Usage: ./get-next-version-code.sh +# Usage: ACCESS_TOKEN= ./get-next-version-code.sh set -euo pipefail PACKAGE_NAME="${1:?usage: get-next-version-code.sh }" +ACCESS_TOKEN="${ACCESS_TOKEN:?ACCESS_TOKEN env var must be set to an androidpublisher-scoped access token}" API_BASE="https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${PACKAGE_NAME}" -ACCESS_TOKEN=$(gcloud auth print-access-token) - -EDIT_ID=$(curl -sS -X POST \ +EDIT_RESPONSE=$(curl -sS -X POST \ -H "Authorization: Bearer ${ACCESS_TOKEN}" \ - "${API_BASE}/edits" | jq -r '.id') + "${API_BASE}/edits") +EDIT_ID=$(echo "${EDIT_RESPONSE}" | jq -r '.id') if [[ -z "${EDIT_ID}" || "${EDIT_ID}" == "null" ]]; then - echo "Failed to create a Play Console edit for ${PACKAGE_NAME}" >&2 + echo "Failed to create a Play Console edit for ${PACKAGE_NAME}. Response:" >&2 + echo "${EDIT_RESPONSE}" >&2 exit 1 fi