GitHub Actions推送镜像至GCP Artifact Registry遇权限错误求助

推送步骤出现如下错误：

denied: Permission "artifactregistry.repositories.uploadArtifacts" denied on resource "projects/PROJECT_ID/locations/asia-south1/repositories/images" (or it may not exist) Error: Process completed with exit code 1.

对应的GitHub Actions工作流代码：

name: Build image and push to Artifact Registry of GCP
on: 
  push:
    branches: 
      - master
 
jobs:
  build-push-artifact:
    name : Build and push Artifact Registry
    runs-on: ubuntu-latest

    steps:
    - name: Checkout
      uses: actions/checkout@v2

    - id: 'auth'
      uses: 'google-github-actions/auth@v1'
      with:
        credentials_json: '${{ secrets.ACCOUNT_KEY }}'

    - name: 'Set up Cloud SDK'
      uses: 'google-github-actions/setup-gcloud@v1'

    - name: 'Use gcloud CLI'
      run: 'gcloud info'

    - name: build Docker Image
      run: docker build -t MY_IMAGE:latest .
    
    - name: Configure Docker Client of Gcloud
      run:  |-
        gcloud auth configure-docker --quiet
        gcloud auth configure-docker asia-south1-docker.pkg.dev --quiet
    
    - name: Push Docker Image to Artifact Registry 
      env:
        GIT_TAG: v0.1.0
      run:  |-
        docker tag MY_IMAGE:latest asia-south1-docker.pkg.dev/PROJECT_ID/images/MY_IMAGE:latest
        docker tag MY_IMAGE:latest asia-south1-docker.pkg.dev/PROJECT_ID/images/MY_IMAGE:$GIT_TAG
        docker push asia-south1-docker.pkg.dev/PROJECT_ID/images/MY_IMAGE:latest
        docker push asia-south1-docker.pkg.dev/PROJECT_ID/images/MY_IMAGE:$GIT_TAG

已为对应服务账号邮箱赋予Artifact Registry Write主体权限，其他步骤均执行成功，仅最后推送步骤失败。

• 确认权限的作用范围
  登录GCP控制台，进入目标Artifact Registry仓库（asia-south1区域的images仓库）的权限设置页面，搜索服务账号邮箱，确认Artifact Registry Writer角色是否直接绑定到该仓库，而非仅绑定到项目层级（避免仓库级别的权限覆盖）。

• 验证服务账号密钥有效性
  取出GitHub Secrets中ACCOUNT_KEY对应的JSON文件，在本地执行以下命令测试推送：

  gcloud auth activate-service-account --key-file=your-key.json
  gcloud auth configure-docker asia-south1-docker.pkg.dev --quiet
  docker tag MY_IMAGE:latest asia-south1-docker.pkg.dev/PROJECT_ID/images/MY_IMAGE:test
  docker push asia-south1-docker.pkg.dev/PROJECT_ID/images/MY_IMAGE:test
  

  如果本地也失败，说明密钥或权限本身有问题；如果本地成功，则排查GitHub Actions环境的认证问题。

• 检查仓库是否存在且信息匹配
  执行gcloud artifacts repositories list --location=asia-south1，确认images仓库存在，且区域、名称与工作流中的完全一致（注意拼写错误，比如asia-south1是否写成asia-south）。

• 确保Docker认证生效
  在工作流的Configure Docker Client of Gcloud步骤后，添加验证步骤，确认认证状态：

  - name: Verify Docker Auth
    run: |-
      gcloud auth list
      docker login -u oauth2accesstoken -p "$(gcloud auth print-access-token)" asia-south1-docker.pkg.dev --quiet
  

  手动触发Docker登录，确保GCP的认证凭证已正确配置到Docker客户端。

• 添加具体权限补全
  如果Artifact Registry Writer角色未生效，直接给服务账号添加artifactregistry.repositories.uploadArtifacts这个单独权限，作用域设置为目标仓库projects/PROJECT_ID/locations/asia-south1/repositories/images，避免角色继承的问题。

内容的提问来源于stack exchange，提问作者Nikhil kumar