fix: Resolving google-github-actions/auth@v1.1.1 failures (#3279)

* fix: resolve persistent 'google-github-actions/auth failed with: retry function failed after 4 attempts' error

* fix: updating missing permissions for github actions jobs for existing workflows

* fix merge conflict

---------

Co-authored-by: Karl Weinmeister <kweinmeister@google.com>

.github/workflows/appengine-analytics.yaml

@@ -33,18 +33,27 @@ on:
   - cron:  '0 0 * * 0'
 jobs:
   test:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     uses: ./.github/workflows/test.yaml
     with:
       name: 'appengine-analytics'
       path: 'appengine/analytics'
   remove_label:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: |
       github.event.action == 'labeled' &&
       github.event.label.name == 'actions:force-run' &&
       always()
     uses: ./.github/workflows/remove-label.yaml
   flakybot:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
     uses: ./.github/workflows/flakybot.yaml
     needs: [test]

.github/workflows/appengine-building-an-app-build.yaml

@@ -33,18 +33,27 @@ on:
   - cron:  '0 0 * * 0'
 jobs:
   test:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     uses: ./.github/workflows/test.yaml
     with:
       name: 'appengine-building-an-app-build'
       path: 'appengine/building-an-app/build'
   remove_label:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: |
       github.event.action == 'labeled' &&
       github.event.label.name == 'actions:force-run' &&
       always()
     uses: ./.github/workflows/remove-label.yaml
   flakybot:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
     uses: ./.github/workflows/flakybot.yaml
     needs: [test]

.github/workflows/appengine-building-an-app-update.yaml

@@ -33,18 +33,27 @@ on:
   - cron:  '0 0 * * 0'
 jobs:
   test:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     uses: ./.github/workflows/test.yaml
     with:
       name: 'appengine-building-an-app-update'
       path: 'appengine/building-an-app/update'
   remove_label:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: |
       github.event.action == 'labeled' &&
       github.event.label.name == 'actions:force-run' &&
       always()
     uses: ./.github/workflows/remove-label.yaml
   flakybot:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
     uses: ./.github/workflows/flakybot.yaml
     needs: [test]

.github/workflows/appengine-datastore.yaml

@@ -33,18 +33,27 @@ on:
   - cron:  '0 0 * * 0'
 jobs:
   test:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     uses: ./.github/workflows/test.yaml
     with:
       name: 'appengine-datastore'
       path: 'appengine/datastore'
   remove_label:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: |
       github.event.action == 'labeled' &&
       github.event.label.name == 'actions:force-run' &&
       always()
     uses: ./.github/workflows/remove-label.yaml
   flakybot:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
     uses: ./.github/workflows/flakybot.yaml
     needs: [test]

.github/workflows/appengine-endpoints.yaml

@@ -33,18 +33,27 @@ on:
   - cron:  '0 0 * * 0'
 jobs:
   test:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     uses: ./.github/workflows/test.yaml
     with:
       name: 'appengine-endpoints'
       path: 'appengine/endpoints'
   remove_label:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: |
       github.event.action == 'labeled' &&
       github.event.label.name == 'actions:force-run' &&
       always()
     uses: ./.github/workflows/remove-label.yaml
   flakybot:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
     uses: ./.github/workflows/flakybot.yaml
     needs: [test]

.github/workflows/appengine-hello-world-flexible.yaml

@@ -33,18 +33,27 @@ on:
   - cron:  '0 0 * * 0'
 jobs:
   test:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     uses: ./.github/workflows/test.yaml
     with:
       name: 'appengine-hello-world-flexible'
       path: 'appengine/hello-world/flexible'
   remove_label:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: |
       github.event.action == 'labeled' &&
       github.event.label.name == 'actions:force-run' &&
       always()
     uses: ./.github/workflows/remove-label.yaml
   flakybot:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
     uses: ./.github/workflows/flakybot.yaml
     needs: [test]

.github/workflows/appengine-hello-world-standard.yaml

@@ -33,18 +33,27 @@ on:
   - cron:  '0 0 * * 0'
 jobs:
   test:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     uses: ./.github/workflows/test.yaml
     with:
       name: 'appengine-hello-world-standard'
       path: 'appengine/hello-world/standard'
   remove_label:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: |
       github.event.action == 'labeled' &&
       github.event.label.name == 'actions:force-run' &&
       always()
     uses: ./.github/workflows/remove-label.yaml
   flakybot:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
     uses: ./.github/workflows/flakybot.yaml
     needs: [test]

.github/workflows/appengine-memcached.yaml

@@ -33,18 +33,27 @@ on:
   - cron:  '0 0 * * 0'
 jobs:
   test:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     uses: ./.github/workflows/test.yaml
     with:
       name: 'appengine-memcached'
       path: 'appengine/memcached'
   remove_label:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: |
       github.event.action == 'labeled' &&
       github.event.label.name == 'actions:force-run' &&
       always()
     uses: ./.github/workflows/remove-label.yaml
   flakybot:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
     uses: ./.github/workflows/flakybot.yaml
     needs: [test]

.github/workflows/appengine-metadata-flexible.yaml

@@ -33,18 +33,27 @@ on:
   - cron:  '0 0 * * 0'
 jobs:
   test:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     uses: ./.github/workflows/test.yaml
     with:
       name: 'appengine-metadata-flexible'
       path: 'appengine/metadata/flexible'
   remove_label:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: |
       github.event.action == 'labeled' &&
       github.event.label.name == 'actions:force-run' &&
       always()
     uses: ./.github/workflows/remove-label.yaml
   flakybot:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
     uses: ./.github/workflows/flakybot.yaml
     needs: [test]

.github/workflows/appengine-metadata-standard.yaml

@@ -33,18 +33,27 @@ on:
   - cron:  '0 0 * * 0'
 jobs:
   test:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     uses: ./.github/workflows/test.yaml
     with:
       name: 'appengine-metadata-standard'
       path: 'appengine/metadata/standard'
   remove_label:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: |
       github.event.action == 'labeled' &&
       github.event.label.name == 'actions:force-run' &&
       always()
     uses: ./.github/workflows/remove-label.yaml
   flakybot:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
     uses: ./.github/workflows/flakybot.yaml
     needs: [test]

.github/workflows/appengine-pubsub.yaml

@@ -33,18 +33,27 @@ on:
   - cron:  '0 0 * * 0'
 jobs:
   test:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     uses: ./.github/workflows/test.yaml
     with:
       name: 'appengine-pubsub'
       path: 'appengine/pubsub'
   remove_label:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: |
       github.event.action == 'labeled' &&
       github.event.label.name == 'actions:force-run' &&
       always()
     uses: ./.github/workflows/remove-label.yaml
   flakybot:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
     uses: ./.github/workflows/flakybot.yaml
     needs: [test]

.github/workflows/appengine-static-files.yaml

@@ -33,18 +33,27 @@ on:
   - cron:  '0 0 * * 0'
 jobs:
   test:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     uses: ./.github/workflows/test.yaml
     with:
       name: 'appengine-static-files'
       path: 'appengine/static-files'
   remove_label:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: |
       github.event.action == 'labeled' &&
       github.event.label.name == 'actions:force-run' &&
       always()
     uses: ./.github/workflows/remove-label.yaml
   flakybot:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
     uses: ./.github/workflows/flakybot.yaml
     needs: [test]

.github/workflows/appengine-storage-flexible.yaml

@@ -33,18 +33,27 @@ on:
   - cron:  '0 0 * * 0'
 jobs:
   test:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     uses: ./.github/workflows/test.yaml
     with:
       name: 'appengine-storage-flexible'
       path: 'appengine/storage/flexible'
   remove_label:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: |
       github.event.action == 'labeled' &&
       github.event.label.name == 'actions:force-run' &&
       always()
     uses: ./.github/workflows/remove-label.yaml
   flakybot:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
     uses: ./.github/workflows/flakybot.yaml
     needs: [test]

.github/workflows/appengine-storage-standard.yaml

@@ -33,18 +33,27 @@ on:
   - cron:  '0 0 * * 0'
 jobs:
   test:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     uses: ./.github/workflows/test.yaml
     with:
       name: 'appengine-storage-standard'
       path: 'appengine/storage/standard'
   remove_label:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: |
       github.event.action == 'labeled' &&
       github.event.label.name == 'actions:force-run' &&
       always()
     uses: ./.github/workflows/remove-label.yaml
   flakybot:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
     uses: ./.github/workflows/flakybot.yaml
     needs: [test]