From d9d019312d31b67e0cecb64a9dd728cb4a5a5ebf Mon Sep 17 00:00:00 2001 From: Gabor Demeter Date: Thu, 20 Aug 2026 19:45:26 +0200 Subject: [PATCH] docs: note credential-source:gcp and the jwt_key raw-PEM encoding rule MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit sf-org-login's action.yml comment already states this; the reference doc was written before PR #33 added credential-source:gcp and didn't carry it. Root-caused for real against a live salesforce-devhub secret and a GitHub Actions run — see gforce-google-infra's docs/SECRETS.md for the seeding side of the same rule. --- docs/claude-actions-reference.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/docs/claude-actions-reference.md b/docs/claude-actions-reference.md index e533613..65b8f80 100644 --- a/docs/claude-actions-reference.md +++ b/docs/claude-actions-reference.md @@ -174,7 +174,16 @@ The single login action — **two credential sources, one contract**. `auth-meth > `devhub`/`true`. > **Stale:** this entry predates PR #16 and omits the `credential-source: github-env` input it -> added. Details in the note under `smoke-sf-org-login.yml` below. +> added. Details in the note under `smoke-sf-org-login.yml` below. It also predates PR #33, which +> added `credential-source: gcp` (via `gcp-secret-get`) — not documented here yet either. + +> **`jwt_key` encoding rule (`credential-source: gcp`):** the GCP Secret Manager secret's +> `jwt_key` field must be the raw, multi-line PEM — this action base64-encodes it itself in +> "Stage credentials from GCP" (`sf-org-login/action.yml`). A pre-base64-encoded `jwt_key` fails +> here with "Decoded JWT key is not a PEM private key", because it gets double-encoded then +> single-decoded. This happened for real on `salesforce-devhub` (fixed 2026-08-20, root cause and +> the seeding convention are in `gforce-google-infra`'s `docs/SECRETS.md`) — if this error shows +> up again, the fix is in that repo's secret data, not in this action's code. ### `sf-source-delta` (`.github/actions/sf-source-delta/action.yml`)