|
| 1 | +# Workflows |
| 2 | + |
| 3 | +## Authenticating and Initializing Earth Engine in GitHub Actions |
| 4 | + |
| 5 | +The |
| 6 | +[publish-to-pypi](https://github.com/google/earthengine-api/blob/master/.github/workflows/publish-to-pypi.yml) |
| 7 | +workflow uses the |
| 8 | +[google-github-actions/auth](https://github.com/google-github-actions/auth) |
| 9 | +GitHub action to authenticate with Google Cloud (see the snippet below). |
| 10 | + |
| 11 | +### Authenticating via Workload Identity Federation |
| 12 | + |
| 13 | +The Earth Engine smoke tests authenticate using workload identity federation. |
| 14 | +See |
| 15 | +[this guide](https://github.com/google-github-actions/auth?tab=readme-ov-file#workload-identity-federation-through-a-service-account) to |
| 16 | +create a workload identity provider and populate the resulting `service_account` |
| 17 | +and `workload_identity_provider` in your GitHub repository's Secrets and |
| 18 | +Variables settings. |
| 19 | + |
| 20 | +```yml |
| 21 | +jobs: |
| 22 | + smoke-test: |
| 23 | + runs-on: ubuntu-latest |
| 24 | + permissions: |
| 25 | + id-token: write |
| 26 | + steps: |
| 27 | + - uses: actions/checkout@v4 |
| 28 | + - name: Set up Python |
| 29 | + uses: actions/setup-python@v3 |
| 30 | + with: |
| 31 | + python-version: 3.11 |
| 32 | + - name: Authenticate with Google Cloud |
| 33 | + uses: 'google-github-actions/auth@v2' |
| 34 | + with: |
| 35 | + service_account: ${{ secrets.SERVICE_ACCOUNT }} |
| 36 | + workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }} |
| 37 | +``` |
| 38 | +
|
| 39 | +The path to the credentials is stored in the |
| 40 | +[`GOOGLE_APPLICATION_CREDENTIALS`](https://cloud.google.com/docs/authentication/application-default-credentials#GAC) |
| 41 | +environment variable. To authenticate and initialize Earth Engine using the |
| 42 | +credentials, see the snippet below. |
| 43 | + |
| 44 | +```python |
| 45 | +import json |
| 46 | +import os |
| 47 | +
|
| 48 | +from google.auth import identity_pool |
| 49 | +
|
| 50 | +scopes = [ |
| 51 | + "https://www.googleapis.com/auth/cloud-platform", |
| 52 | + "https://www.googleapis.com/auth/earthengine", |
| 53 | +] |
| 54 | +path = os.environ["GOOGLE_APPLICATION_CREDENTIALS"] |
| 55 | +info = json.load(open(path)) |
| 56 | +credentials = identity_pool.Credentials.from_info(info).with_scopes(scopes) |
| 57 | +ee.Initialize(credentials, project=credentials.project_number) |
| 58 | +``` |
0 commit comments