Ground Maintainer's Guide

Renewing the Ground GitHub deployment key

This applies when you see failures on the deploy-to-firebase-on-merge action. Typically, you would see errors of the form:

"error": "Failed to authenticate, have you run firebase login?"

To fix this, you need to renew the key for the service account used to deploy to Firebase

1. Navigate to https://console.cloud.google.com/iam-admin/serviceaccounts and select the Ground dev project.
2. Identify the service account with the description "Used by GitHub actions to deploy to Firebase".
3. Run the following command using the project and service account identified in steps 1 and 2:

gcloud iam service-accounts keys create /tmp/gnd-key.json \
   --iam-account=<service-account>@appspot.gserviceaccount.com --project=<project name>

1. This will create a new active service account key, writing credentials to /tmp/gnd-key.json. Next, run:

cat /tmp/gnd-key.json

and copy the output to your clipboard.

1. Then, go to https://github.com/google/ground-platform/settings/secrets/actions and update the FIREBASE_SERVICE_ACCOUNT_GND_DEV secret by just pasting the JSON object you copied in step 5.
2. Save and Done. You can now rerun the failing GitHub Action here.