🦄 feature: Support Custom Service Accounts (#373)

* 💽 incremental change

* 💽 incremental change

README.md

@@ -60,6 +60,7 @@ jobs:
 | gcp_artifact_repository | yes | The Artifact Registry name, you can override for custom names (i.e. the 'acme' in us-docker.pkg.dev/able-sailor-21423/acme) | - |
 | github_token | yes | Github Token, pass in the `secrets.GITHUB_TOKEN`. | - |
 | port | no | The port that the application will run on in the container. | 8080 |
+| service_account | no | The service account to be used for the Cloud Run service. | - |
 | env_vars | no | List of environment variables that will be injected during runtime, each on a new line. | - |
 | secrets | no | List of secrets that will be injected during runtime, each on a new line. | - |
 | flags | no | List of flags that will be injected during runtime. | - |

action.yaml

@@ -16,6 +16,9 @@ inputs:
     description: "The port that the application will run on in the container."
     required: false
     default: "8080"
+  service_account:
+    description: "The service account to be used for the Cloud Run service."
+    required: false
   env_vars:
     description: "List of environment variables that will be injected during runtime, each on a new line."
     required: false
@@ -43,7 +46,7 @@ inputs:
     description: "A tag to be applied to the Cloud Run service, used for ingress or other permissions."
     required: false
     default: "tagValues/281479867842234"
-  
+
   #------------------
   # Pull Request Integration
   #------------------
@@ -133,7 +136,7 @@ runs:
         service: 'pvw-${{ inputs.gcp_artifact_repository }}-${{ inputs.name }}-pr${{ steps.pr-number.outputs.result }}'
         image: 'us-docker.pkg.dev/${{ inputs.gcp_project_id }}/${{ inputs.gcp_artifact_repository }}/${{ inputs.name }}:${{ github.sha }}'
         region: '${{ inputs.gcp_region }}'
-        flags: '${{ inputs.flags }} --allow-unauthenticated --port=${{ inputs.port }} --service-account=${{ fromJSON(inputs.gcp_service_account_key).client_email }}'
+        flags: '${{ inputs.flags }} --allow-unauthenticated --port=${{ inputs.port }} --service-account=${{ inputs.service_account || fromJSON(inputs.gcp_service_account_key).client_email }}'
         env_vars: ${{ inputs.env_vars }}
         secrets: ${{ inputs.secrets }}
         labels: |
@@ -145,10 +148,10 @@ runs:
     - name: '🏷️ Tag Cloud Run Service for Ingress'
       uses: actions/github-script@v7
       env:
-        GCP_TAG: '${{ inputs.gcp_tag }}'
+        SERVICE_NAME: 'pvw-${{ inputs.gcp_artifact_repository }}-${{ inputs.name }}-pr${{ steps.pr-number.outputs.result }}'
         GCP_PROJECT_ID: '${{ inputs.gcp_project_id }}'
         GCP_REGION: '${{ inputs.gcp_region }}' 
-        SERVICE_NAME: 'pvw-${{ inputs.gcp_artifact_repository }}-${{ inputs.name }}-pr${{ steps.pr-number.outputs.result }}'
+        GCP_TAG: '${{ inputs.gcp_tag }}'
       with:
         github-token: ${{ inputs.github_token }}
         script: |

scripts/gcp-resource-tag.js

@@ -16,9 +16,9 @@ function getInput(env, name) {
  * @param {object} payload.env
  */
 module.exports = async ({ exec, env }) => {
+  const serviceName = getInput(env, 'SERVICE_NAME');
   const gcpProjectId = getInput(env, 'GCP_PROJECT_ID');
   const gcpRegion = getInput(env, 'GCP_REGION');
-  const serviceName = getInput(env, 'SERVICE_NAME');
   const gcpTag = getInput(env, 'GCP_TAG');
 
   try {