CI: fix access-token scope for get-next-version-code.sh

.github/workflows/pre-release-upload.yml

@@ -33,13 +33,17 @@ jobs:
         run: echo $GOOGLE_SERVICES_JSON_B64 | base64 -d > app/google-services.json
 
       - name: Authenticate to Google Play
+        id: play_auth
         uses: google-github-actions/auth@v2
         with:
           credentials_json: ${{ secrets.PLAY_STORE_CREDENTIALS }}
+          token_format: access_token
           access_token_scopes: https://www.googleapis.com/auth/androidpublisher
 
       - name: Compute next versionCode
         id: version_code
+        env:
+          ACCESS_TOKEN: ${{ steps.play_auth.outputs.access_token }}
         run: |
           value=$(./scripts/get-next-version-code.sh com.willowtree.vocable)
           echo "value=$value" >> "$GITHUB_OUTPUT"

.github/workflows/ps-release.yml

@@ -41,13 +41,17 @@ jobs:
         run: echo $ENCODED_RELEASE_KEYSTORE | base64 -d > keystore
 
       - name: Authenticate to Google Play
+        id: play_auth
         uses: google-github-actions/auth@v2
         with:
           credentials_json: ${{ secrets.PLAY_STORE_CREDENTIALS }}
+          token_format: access_token
           access_token_scopes: https://www.googleapis.com/auth/androidpublisher
 
       - name: Compute next versionCode
         id: version_code
+        env:
+          ACCESS_TOKEN: ${{ steps.play_auth.outputs.access_token }}
         run: |
           value=$(./scripts/get-next-version-code.sh com.willowtree.vocable)
           echo "value=$value" >> "$GITHUB_OUTPUT"

scripts/get-next-version-code.sh

@@ -11,25 +11,31 @@
 # a versionCode <= one already used on any track. Querying Play directly for
 # ground truth removes the dependency on run history entirely.
 #
-# Requires: an active `gcloud` auth session for a service account with access
-# to the Play Developer API for this app (see google-github-actions/auth in
-# the calling workflow), and `curl`/`jq` on PATH.
+# Requires an OAuth access token scoped to
+# https://www.googleapis.com/auth/androidpublisher in $ACCESS_TOKEN — plain
+# `gcloud auth print-access-token` mints one scoped to cloud-platform instead,
+# which the Android Publisher API rejects, so the calling workflow must set
+# `token_format: access_token` + `access_token_scopes` on
+# google-github-actions/auth and pass its `access_token` output through
+# rather than relying on the ADC credentials file. Also requires `curl`/`jq`
+# on PATH.
 #
-# Usage: ./get-next-version-code.sh <package-name>
+# Usage: ACCESS_TOKEN=<token> ./get-next-version-code.sh <package-name>
 
 set -euo pipefail
 
 PACKAGE_NAME="${1:?usage: get-next-version-code.sh <package-name>}"
+ACCESS_TOKEN="${ACCESS_TOKEN:?ACCESS_TOKEN env var must be set to an androidpublisher-scoped access token}"
 API_BASE="https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${PACKAGE_NAME}"
 
-ACCESS_TOKEN=$(gcloud auth print-access-token)
-
-EDIT_ID=$(curl -sS -X POST \
+EDIT_RESPONSE=$(curl -sS -X POST \
   -H "Authorization: Bearer ${ACCESS_TOKEN}" \
-  "${API_BASE}/edits" | jq -r '.id')
+  "${API_BASE}/edits")
+EDIT_ID=$(echo "${EDIT_RESPONSE}" | jq -r '.id')
 
 if [[ -z "${EDIT_ID}" || "${EDIT_ID}" == "null" ]]; then
-  echo "Failed to create a Play Console edit for ${PACKAGE_NAME}" >&2
+  echo "Failed to create a Play Console edit for ${PACKAGE_NAME}. Response:" >&2
+  echo "${EDIT_RESPONSE}" >&2
   exit 1
 fi