diff --git a/templates/gitlab-ci-python-gcp.yml b/templates/gitlab-ci-python-gcp.yml index 24f4770fddbd39fdce5035d0361c553e42fca110..2a462be960e921064c3831d447d347137c93faac 100644 --- a/templates/gitlab-ci-python-gcp.yml +++ b/templates/gitlab-ci-python-gcp.yml @@ -20,23 +20,27 @@ variables: GCP_OIDC_PROVIDER: $[[ inputs.gcp-oidc-provider ]] .python-gcp-adc: - - set -e - - echo -e "[\\e[1;94mINFO\\e[0m] Installing GCP authentication with env GOOGLE_APPLICATION_CREDENTIALS file" - - echo $GCP_JWT > "$CI_BUILDS_DIR/.auth_token.jwt" - - |- - cat << EOF > "$CI_BUILDS_DIR/google_application_credentials.json" - { - "type": "external_account", - "audience": "//iam.googleapis.com/${GCP_OIDC_PROVIDER}", - "subject_token_type": "urn:ietf:params:oauth:token-type:jwt", - "token_url": "https://sts.googleapis.com/v1/token", - "credential_source": { - "file": "$CI_BUILDS_DIR/.auth_token.jwt" - }, - "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${GCP_OIDC_ACCOUNT}:generateAccessToken" - } + - | + if [[ "$GCP_JWT" ]] + then + echo -e "[\\e[1;94mINFO\\e[0m] Installing GCP authentication with env GOOGLE_APPLICATION_CREDENTIALS file" + echo $GCP_JWT > "$CI_BUILDS_DIR/.auth_token.jwt" + cat << EOF > "$CI_BUILDS_DIR/google_application_credentials.json" + { + "type": "external_account", + "audience": "//iam.googleapis.com/${GCP_OIDC_PROVIDER}", + "subject_token_type": "urn:ietf:params:oauth:token-type:jwt", + "token_url": "https://sts.googleapis.com/v1/token", + "credential_source": { + "file": "$CI_BUILDS_DIR/.auth_token.jwt" + }, + "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${GCP_OIDC_ACCOUNT}:generateAccessToken" + } EOF - - export GOOGLE_APPLICATION_CREDENTIALS="$CI_BUILDS_DIR/google_application_credentials.json" + export GOOGLE_APPLICATION_CREDENTIALS="$CI_BUILDS_DIR/google_application_credentials.json" + else + echo '[WARN] $GCP_JWT is not set: cannot setup Application Default Credentials (ADC) authentication' + fi .python-base: image: $PYTHON_IMAGE