[alonsopf89]

Fixes the Authenticate to Google Cloud failure in nightly.yml run #40445261508 reported in #6092.

Cause

OSS Exit Gate uses Direct Workload Identity Federation (projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github) without service account impersonation. In google-github-actions/auth@v3, passing token_format: 'access_token' triggers an additional IAM Credentials generateAccessToken call that requires a service_account input.

Fix

• Omit token_format: 'access_token' so google-github-actions/auth@v3 exchanges the GitHub OIDC token directly via STS and exports the federated token in steps.auth.outputs.auth_token (as well as GOOGLE_APPLICATION_CREDENTIALS for gcloud storage cp).
• Update ACCESS_TOKEN to read ${{ steps.auth.outputs.auth_token }} in both .github/workflows/nightly.yml and .github/workflows/publish.yml.
• No additional GitHub repository secrets or environment settings are needed.

Ref: b/576685153

[asyncliz]

@alonsopf89 the GitHub action worked, but we're getting error emails for the nightly release:

"The manifest file uploaded to the GCS bucket is not a valid textproto or json file."

[alonsopf89]

Thanks for catching and reporting this @asyncliz!

I investigated the manifest uploaded by last night's run (gs://oss-exit-gate-prod-projects-bucket/material-web/npm/manifests/manifest-40812407023-1.json) and found the root cause:

1. In OSS Exit Gate's PublishingManifest protobuf schema, "registry_config": { "npm": { "tags": ["nightly"] } } is a top-level field on the root JSON object (sibling of publishing_groups), not a field inside publishing_groups[0]. Because PublishingGroup does not have a registry_config field, Exit Gate's protobuf JSON parser rejected the manifest with "The manifest file uploaded to the GCS bucket is not a valid textproto or json file."
2. Additionally, for scoped packages (@material/web), publishing_groups[0] requires "namespace": "@material" and "packages": [{ "name": "web", "version": $ver }] to match pkg_namespace: "@material" / pkg: "web" in the project config.

I opened #6100 to fix both .github/workflows/nightly.yml and .github/workflows/publish.yml (and also added a pre-publish gcloud artifacts packages delete "@material/web" ... || true cleanup step so re-running on the same commit won't hit Artifact Registry version immutability).