如何在CircleCI任务中配置GOOGLE_APPLICATION_CREDENTIALS？

1. 修正环境变量写入方式 #

你当前设置GOOGLE_APPLICATION_CREDENTIALS的命令存在错误，直接执行export ... >> $BASH_ENV不会将变量定义写入环境配置文件。正确写法是把export命令作为字符串追加到$BASH_ENV中，确保后续步骤的shell能加载该变量：

- run:
    name: set to the env var
    command: |
      echo 'export GOOGLE_APPLICATION_CREDENTIALS="${HOME}/keys.json"' >> $BASH_ENV
      source $BASH_ENV  # 可选，让当前步骤也能使用该变量
      gcloud auth activate-service-account --key-file ${HOME}/keys.json

2. 确保base64解码完整 #

解码凭证时，给$GOOGLE_APPLICATION_CREDENTIALS加上双引号，避免shell解析特殊字符、换行导致文件内容损坏：

- run:
    name: copy to a file
    command: |
      echo "$GOOGLE_APPLICATION_CREDENTIALS" | base64 -d > ${HOME}/keys.json
      cat ${HOME}/keys.json  # 验证文件内容是否正确

3. 验证路径与变量生效 #

可在pytest步骤前新增验证步骤，确认变量和文件状态：

- run:
    name: verify credentials setup
    command: |
      echo "GOOGLE_APPLICATION_CREDENTIALS value: $GOOGLE_APPLICATION_CREDENTIALS"
      ls -l ${HOME}/keys.json

完整修正后的配置 #

test-job:
    docker:
      - image: cimg/python:3.9.9
    steps:
      - checkout
      - run:
        name: decode service account key
        command: |
          echo "$GOOGLE_APPLICATION_CREDENTIALS" | base64 -d > ${HOME}/keys.json
          cat ${HOME}/keys.json

      - run:
        name: configure google credentials env var
        command: |
          echo 'export GOOGLE_APPLICATION_CREDENTIALS="${HOME}/keys.json"' >> $BASH_ENV
          source $BASH_ENV
          gcloud auth activate-service-account --key-file ${HOME}/keys.json

      - run:
        name: verify setup
        command: |
          echo "Credentials path: $GOOGLE_APPLICATION_CREDENTIALS"
          ls -l $GOOGLE_APPLICATION_CREDENTIALS

      - run:
        name: install dependencies
        command: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt

      - run:
        name: run pytest
        command: |
          pytest

关键问题说明 #

• CircleCI的每个run步骤都是独立shell进程，默认不会继承上一步的环境变量，必须通过写入$BASH_ENV并source让变量在后续步骤生效。
• 解码base64时不加双引号，可能导致凭证内容中的空格、换行或特殊字符被shell截断，生成的JSON文件损坏，最终引发认证失败。

内容的提问来源于stack exchange，提问作者Amogh Mishra