{"record":{"id":"1ddc02b96aa66e9c","repo":"apache/beam","slug":"failed-to-create-gcs-client-staging","errorCode":null,"errorMessage":"failed to create GCS client","messagePattern":"failed to create GCS client","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sdks/go/pkg/beam/artifact/gcsproxy/staging.go","lineNumber":85,"sourceCode":"func (s *StagingServer) CommitManifest(ctx context.Context, req *jobpb.CommitManifestRequest) (*jobpb.CommitManifestResponse, error) {\n\tmanifest := req.GetManifest()\n\n\ts.mu.Lock()\n\tloc, err := matchLocations(manifest.GetArtifact(), s.blobs)\n\tif err != nil {\n\t\ts.mu.Unlock()\n\t\treturn nil, err\n\t}\n\ts.mu.Unlock()\n\n\tdata, err := proto.Marshal(&jobpb.ProxyManifest{Manifest: manifest, Location: loc})\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to marshal proxy manifest\")\n\t}\n\n\tcl, err := gcsx.NewClient(ctx, storage.ScopeReadWrite)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to create GCS client\")\n\t}\n\tif err := gcsx.WriteObject(ctx, cl, s.bucket, s.manifest, bytes.NewReader(data)); err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to write manifest\")\n\t}\n\n\t// Commit returns the location of the manifest as the token, which can\n\t// then be used to configure the retrieval proxy. It is redundant right\n\t// now, but would be needed for a staging server that serves multiple\n\t// jobs. Such a server would also use the ID sent with each request.\n\n\treturn &jobpb.CommitManifestResponse{RetrievalToken: gcsx.MakeObject(s.bucket, s.manifest)}, nil\n}\n\n// matchLocations ensures that all artifacts have been staged and have valid\n// content. It is fine for staged artifacts to not appear in the manifest.\nfunc matchLocations(artifacts []*jobpb.ArtifactMetadata, blobs map[string]staged) ([]*jobpb.ProxyManifest_Location, error) {\n\tvar loc []*jobpb.ProxyManifest_Location\n\tfor _, a := range artifacts {","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/go/pkg/beam/artifact/gcsproxy/staging.go#L67-L103","documentation":"CommitManifest creates a GCS client with read-write scope to upload the marshaled ProxyManifest. Failure to construct that client (missing credentials, no network to Google APIs, bad environment) is wrapped with this message.","triggerScenarios":"gcsx.NewClient(ctx, storage.ScopeReadWrite) returns an error inside CommitManifest — typically google.FindDefaultCredentials fails because no Application Default Credentials are available.","commonSituations":"Running outside GCP without GOOGLE_APPLICATION_CREDENTIALS set; no gcloud application-default credentials configured; metadata server unreachable; network/firewall blocking oauth2.googleapis.com; service account JSON key file path wrong.","solutions":["Set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON key with storage read-write access, or run `gcloud auth application-default login`.","Run on GCP infrastructure (GCE/GKE/Cloud Run) where the metadata server supplies credentials automatically.","Verify network access to oauth2.googleapis.com and storage.googleapis.com (proxies/VPN/firewalls).","Confirm the GOOGLE_CLOUD_PROJECT or quota project is set if required by your auth setup."],"exampleFix":"// before\ncommitCtx := context.Background()\n// after: ensure credentials exist first, with a clear failure\ncreds, err := google.FindDefaultCredentials(ctx, storage.ScopeReadWrite)\nif err != nil {\n\treturn nil, fmt.Errorf(\"set GOOGLE_APPLICATION_CREDENTIALS: %w\", err)\n}\n_ = creds\n// then call CommitManifest(ctx, token) with ctx carrying auth metadata","handlingStrategy":"try-catch","validationCode":"// Detect credential availability before staging\nif _, err := google.FindDefaultCredentials(ctx, storage.ScopeReadWrite); err != nil {\n\treturn fmt.Errorf(\"no GCP credentials: set GOOGLE_APPLICATION_CREDENTIALS\")\n}","typeGuard":null,"tryCatchPattern":"if err := stage(...); err != nil {\n\tif strings.Contains(err.Error(), \"failed to create GCS client\") {\n\t\t// check GOOGLE_APPLICATION_CREDENTIALS / metadata server, then retry\n\t}\n}","preventionTips":["Set GOOGLE_APPLICATION_CREDENTIALS or run on GCP infrastructure with a service account.","Run `gcloud auth application-default login` for local development.","Verify firewall access to oauth2.googleapis.com."],"tags":["gcs","auth","credentials","google-cloud"],"backgroundTag":"missing-credentials","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T08:17:22.691Z"}