{"record":{"id":"2d35dc69dc7304be","repo":"GoogleContainerTools/skaffold","slug":"failed-to-get-repository-read-access-token-for-rep","errorCode":null,"errorMessage":"failed to get repository read access token for repo %v: %w","messagePattern":"failed to get repository read access token for repo (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/gcbreposv2/repo_resolver.go","lineNumber":60,"sourceCode":"\nvar RepositoryManagerClient = repositoryManagerClient\n\nfunc GetRepoInfo(ctx context.Context, gcpProject, gcpRegion, gcpConnectionName, gcpRepoName string) (Repo, error) {\n\tcbRepoRef := fmt.Sprintf(\"projects/%v/locations/%v/connections/%v/repositories/%v\", gcpProject, gcpRegion, gcpConnectionName, gcpRepoName)\n\tcbClient, err := RepositoryManagerClient(ctx)\n\tif err != nil {\n\t\treturn Repo{}, fmt.Errorf(\"failed to create repository manager client: %w\", err)\n\t}\n\tdefer cbClient.Close()\n\n\trepoURI, err := getRepoURI(ctx, cbClient, cbRepoRef)\n\tif err != nil {\n\t\treturn Repo{}, fmt.Errorf(\"failed to get remote URI for repository %v: %w\", gcpRepoName, err)\n\t}\n\n\treadAccessToken, err := getRepoReadAccessToken(ctx, cbClient, cbRepoRef)\n\tif err != nil {\n\t\treturn Repo{}, fmt.Errorf(\"failed to get repository read access token for repo %v: %w\", gcpRepoName, err)\n\t}\n\n\trepoCloneURI, err := buildRepoURIWithToken(repoURI, readAccessToken)\n\tif err != nil {\n\t\treturn Repo{}, fmt.Errorf(\"failed to clone repo %s: trouble building repo URI with token: %w\", repoURI, err)\n\t}\n\n\treturn Repo{\n\t\tURI:      repoURI,\n\t\tCloneURI: repoCloneURI,\n\t}, nil\n}\n\nfunc repositoryManagerClient(ctx context.Context) (cloudBuildRepoClient, error) {\n\treturn cloudbuild.NewRepositoryManagerClient(ctx)\n}\n\nfunc getRepoURI(ctx context.Context, cbClient cloudBuildRepoClient, cbRepoRef string) (string, error) {","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/gcbreposv2/repo_resolver.go#L42-L78","documentation":"Fires in GetRepoInfo when acquiring a short-lived read-access token for a 2nd-gen Cloud Build (GCB) linked repository fails via the Repository Manager API. Wraps the token-fetch error, typically missing IAM permissions on the connection/repository or an invalid repository reference.","triggerScenarios":"Calling GetRepoInfo when the read-access-token RPC fails: credentials lacking the required scope, no permission to generate access tokens on the connection/repo, token API outage, or context cancellation.","commonSituations":"Service account with viewer but not the connection-specific token-generation permission; workload identity misconfiguration on GKE; expired/quota-limited credentials in long-running CI jobs.","solutions":["Ensure the identity has permission to fetch repository read access tokens (Cloud Build connection viewer/admin).","Re-authenticate: `gcloud auth application-default login` or refresh the service-account key.","Inspect the wrapped cause to distinguish PERMISSION_DENIED vs transport errors.","Retry on transient 5xx / deadline errors."],"exampleFix":"// before: generic Viewer role only\n// after\ngcloud projects add-iam-policy-binding PROJECT \\\n  --member=serviceAccount:SA \\\n  --role=roles/cloudbuild.connectionViewer","handlingStrategy":"try-catch","validationCode":"// Pre-flight: confirm identity can call the token endpoint\n_ = google.FindDefaultCredentials(ctx, \"https://www.googleapis.com/auth/cloud-platform\")","typeGuard":null,"tryCatchPattern":"repo, err := gcbreposv2.GetRepoInfo(ctx, proj, region, conn, name)\nif err != nil && strings.Contains(err.Error(), \"read access token\") {\n    return fmt.Errorf(\"identity lacks token permission; grant cloudbuild.connectionViewer: %w\", err)\n}","preventionTips":["Grant the Cloud Build connection viewer/admin role that permits token generation.","Re-authenticate before long CI runs so tokens/credentials are fresh.","Distinguish PERMISSION_DENIED (IAM fix) from transient 5xx (retry) in the wrapped cause."],"tags":["gcp","auth","token","cloud-build"],"backgroundTag":"google-api-auth-failed","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}