GitHub Actions构建Docker镜像时无法访问GCP Artifact Registry中的Python包

看起来你遇到的问题是Docker构建过程中，pip访问GCP Artifact Registry的Python仓库时缺少认证凭据——虽然你的GitHub Actions runner已经通过OIDC完成了GCP认证，但这个认证信息并没有传递到Docker容器内部的构建环境里，所以pip会弹出要求输入用户名的提示，最终导致安装失败。

下面给你两种可行的解决思路：

方法一：利用Docker BuildKit传递GCP访问令牌（推荐） #

这种方式不需要在镜像里留下敏感凭据，安全性更高：

1. 更新GitHub Actions工作流：
   在Auth to GCP via OIDC步骤之后，添加获取GCP访问令牌的步骤，然后在docker/build-push-action中传递这个令牌作为构建秘密：

   jobs:
     publish:
       runs-on: ubuntu-latest
       permissions:
         contents: 'read'
         id-token: 'write'
       steps:
         - name: Checkout code
           uses: actions/checkout@v4
         - name: Auth to GCP via OIDC
           uses: google-github-actions/auth@v2
           with:
             workload_identity_provider: projects/<ID>/locations/global/workloadIdentityPools/<PROJCTWIP>/providers/<OIDCPROVIDER>
             service_account: <SERVICEACCOUNT>@<PROJECTID>.iam.gserviceaccount.com
         - name: Get GCP access token
           run: echo "ACCESS_TOKEN=$(gcloud auth print-access-token)" >> $GITHUB_ENV
         - name: Set up gcloud
           uses: google-github-actions/setup-gcloud@v2
           with:
             project_id: <PROJECTID>
         - name: Configure Docker for Artifact Registry
           run: gcloud auth configure-docker us-central1-docker.pkg.dev
         - name: Build and push Docker image
           uses: docker/build-push-action@v5
           with:
             context: .
             push: true
             tags: us-central1-docker.pkg.dev/<PROJECTID>/<DOCKERREGISTRY>/myimage:latest
             secrets: |
               "GCP_ACCESS_TOKEN=${{ env.ACCESS_TOKEN }}"
             build-args: |
               PYPI_REGISTRY_URL=https://us-central1-python.pkg.dev/<PROJECTID>/<PYPIREGISTRY>/simple/
   

2. 修改Dockerfile：
   使用BuildKit的秘密来配置pip的认证，同时安装必要的依赖：

   # syntax=docker/dockerfile:1.4
   FROM python:3.12-slim
   
   ARG PYPI_REGISTRY_URL
   ENV PYPI_REGISTRY_URL=$PYPI_REGISTRY_URL
   
   RUN apt-get update && \
       apt-get install -y --no-install-recommends git openssh-client && \
       apt-get clean && \
       rm -rf /var/lib/apt/lists/*
   
   # 安装Artifact Registry认证工具
   RUN pip install keyrings.google-artifactregistry-auth
   
   # 使用传递的访问令牌配置pip认证
   RUN --mount=type=secret,id=GCP_ACCESS_TOKEN \
       echo "[global]" > /etc/pip.conf && \
       echo "extra-index-url = $PYPI_REGISTRY_URL" >> /etc/pip.conf && \
       echo "extra-index-url = https://pypi.org/simple" >> /etc/pip.conf && \
       echo "[$(echo $PYPI_REGISTRY_URL | cut -d/ -f3)]" >> /etc/pip.conf && \
       echo "username = oauth2accesstoken" >> /etc/pip.conf && \
       echo "password = $(cat /run/secrets/GCP_ACCESS_TOKEN)" >> /etc/pip.conf
   
   RUN pip install my-backend==0.1.3 && pip install gunicorn
   
   CMD ["gunicorn", "my_backend.app:app"]
   

方法二：在构建时注入GCP认证环境变量 #

如果不想用BuildKit秘密，也可以直接把访问令牌作为构建参数传递（注意：这种方式令牌会出现在构建历史里，安全性稍低）：

1. 更新GitHub Actions工作流：
   在docker/build-push-action中添加构建参数GCP_ACCESS_TOKEN：

   # ... 其他步骤不变 ...
   - name: Build and push Docker image
     uses: docker/build-push-action@v5
     with:
       context: .
       push: true
       tags: us-central1-docker.pkg.dev/<PROJECTID>/<DOCKERREGISTRY>/myimage:latest
       build-args: |
         PYPI_REGISTRY_URL=https://us-central1-python.pkg.dev/<PROJECTID>/<PYPIREGISTRY>/simple/
         GCP_ACCESS_TOKEN=${{ env.ACCESS_TOKEN }}
   

2. 修改Dockerfile：

   FROM python:3.12-slim
   
   ARG PYPI_REGISTRY_URL
   ARG GCP_ACCESS_TOKEN
   ENV PYPI_REGISTRY_URL=$PYPI_REGISTRY_URL
   
   RUN apt-get update && \
       apt-get install -y --no-install-recommends git openssh-client && \
       apt-get clean && \
       rm -rf /var/lib/apt/lists/*
   
   RUN pip install keyrings.google-artifactregistry-auth
   
   # 配置pip使用访问令牌认证
   RUN echo "[global]" > /etc/pip.conf && \
       echo "extra-index-url = $PYPI_REGISTRY_URL" >> /etc/pip.conf && \
       echo "[$(echo $PYPI_REGISTRY_URL | cut -d/ -f3)]" >> /etc/pip.conf && \
       echo "username = oauth2accesstoken" >> /etc/pip.conf && \
       echo "password = $GCP_ACCESS_TOKEN" >> /etc/pip.conf
   
   RUN pip install my-backend==0.1.3 && pip install gunicorn
   
   CMD ["gunicorn", "my_backend.app:app"]
   

最后别忘了确认你的GCP服务账号<SERVICEACCOUNT>@<PROJECTID>.iam.gserviceaccount.com拥有Artifact Registry Reader角色（即roles/artifactregistry.reader），这样它才能有权限访问Python仓库里的包。

内容来源于stack exchange