authentication not working with google_application_credentials

[JSmithOner]

[REQUIRED] Environment info

firebase-tools: latest

**Platform:**CircleCI

[REQUIRED] Test case

No tests

[REQUIRED] Steps to reproduce

Create an angular node project

Download service account key from firebase project settings or cloud console

encode to base 64 and set the result as an environment variable called SERVICE_ACCOUNT ( I've logged the output of the variable and it's valid )

set this pipeline in CircleCI with this .yml file

version: 2.1
orbs:
  browser-tools: circleci/browser-tools@1.4.0
jobs:
  build:
    working_directory: ~/ng-project
    docker:
      - image: cimg/node:16.13.1-browsers
    steps:
      - browser-tools/install-chrome
      - browser-tools/install-chromedriver
      - run:
          command: |
            google-chrome --version
            chromedriver --version
          name: Check install
      - checkout
      - restore_cache:
          key: ng-project-{{ .Branch }}-{{ checksum "package-lock.json" }}
      - run: npm install
      - run: npm install --save-dev firebase-tools
      - save_cache:
          key: ng-project-{{ .Branch }}-{{ checksum "package-lock.json" }}
          paths:
            - "node_modules"
      - run:
          name: "Run test"
          command: npm run test
      - run:
          name: "Build application for production"
          command: npm run build
      - run: echo $SERVICE_ACCOUNT | base64 --decode > credentials.json
      - run: export GOOGLE_APPLICATION_CREDENTIALS='./credentials.json'
      - run: cat ./credentials.json
      - run:
          name: "Deploy app to Firebase Hosting Preview Channel"
          command: "./node_modules/.bin/firebase hosting:channel:deploy --non-interactive --debug staging"
      - run: rm credentials.json

make change to project

add/commit/push changes

[REQUIRED] Expected behavior

Deploy project to the preview channel

[REQUIRED] Actual behavior

gives me following error:

#!/bin/bash -eo pipefail
./node_modules/.bin/firebase hosting:channel:deploy --non-interactive --debug staging

[2022-09-12T01:02:03.942Z] > command requires scopes: ["email","openid","https://www.googleapis.com/auth/cloudplatformprojects.readonly","https://www.googleapis.com/auth/firebase","https://www.googleapis.com/auth/cloud-platform"]
[2022-09-12T01:02:03.949Z] Error: Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started for more information.
    at GoogleAuth.getApplicationDefaultAsync (/home/circleci/ng-project/node_modules/firebase-tools/node_modules/google-auth-library/build/src/auth/googleauth.js:183:19)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at async GoogleAuth.getClient (/home/circleci/ng-project/node_modules/firebase-tools/node_modules/google-auth-library/build/src/auth/googleauth.js:565:17)
    at async GoogleAuth.getAccessToken (/home/circleci/ng-project/node_modules/firebase-tools/node_modules/google-auth-library/build/src/auth/googleauth.js:587:24)
    at async autoAuth (/home/circleci/ng-project/node_modules/firebase-tools/lib/requireAuth.js:24:19)
    at async requireAuth (/home/circleci/ng-project/node_modules/firebase-tools/lib/requireAuth.js:48:20)
    at async Object.requirePermissions [as fn] (/home/circleci/ng-project/node_modules/firebase-tools/lib/requirePermissions.js:17:5)
    at async /home/circleci/ng-project/node_modules/firebase-tools/lib/command.js:214:17

Error: Failed to authenticate, have you run firebase login?
[2022-09-12T01:02:04.034Z] <<< [apiv2][status] GET https://firebase-public.firebaseio.com/cli.json 200
[2022-09-12T01:02:04.034Z] <<< [apiv2][body] GET https://firebase-public.firebaseio.com/cli.json {"cloudBuildErrorAfter":1594252800000,"cloudBuildWarnAfter":1590019200000,"defaultNode10After":1594252800000,"minVersion":"3.0.5","node8DeploysDisabledAfter":1613390400000,"node8RuntimeDisabledAfter":1615809600000,"node8WarnAfter":1600128000000}

Exited with code exit status 1

CircleCI received exit code 1

[google-oss-bot]

This issue does not have all the information required by the template. Looks like you forgot to fill out some sections. Please update the issue with more information.

[bkendall]

setting GOOGLE_APPLICATION_CREDENTIALS to a relative directory is likely the culprite here:

export GOOGLE_APPLICATION_CREDENTIALS='./credentials.json'

You probably should set it to an absolute path, like

export GOOGLE_APPLICATION_CREDENTIALS="$(pwd)/credentials.json"

[JSmithOner]

@bkendall Thank you for your answer.
before moving to channel preview I was running firebase deploy --only hosting with a service account key made through the google console and it worked great. Now both are not working I've tried back with and without the absolute path and it's not working. as mentioned before the decoded output service account key file looks valid. Any other ideas?

[JSmithOner]

@bkendall fixed the issue
For unknown reasons the environment variable wasn't exporting properly and was empty. I use only now credentials.json and it worked.

...
    docker:
      - image: cimg/node:16.13.1-browsers
        environment:
            GOOGLE_APPLICATION_CREDENTIALS: "credentials.json"
...

[bkendall]

That'll do it! Glad you figured it out!

[sheunglaili]

a bit late to the party but I believe you have to set the environment variable a bit differently on github actions to pass the environment to next step: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#setting-an-environment-variable