Fix Drive push workflow #3

Merged

Xeplosion merged 2 commits from dev into main

2026-08-27 04:45:58 +00:00

Xeplosion commented

2026-08-27 04:45:52 +00:00

Owner

What changed and why

Fixes a storageQuotaExceeded 403 in the push-drive workflow. Service
accounts have zero storage quota outside a Shared Drive — they can edit
files they're shared on but can't create new ones — and the target Drive
folder is owned by a personal Gmail account, so Shared Drives / domain-wide
delegation (both Workspace-only) weren't an option.

Switches Drive uploads over to a personal-account OAuth refresh token
instead, so new files are created under the folder owner's own quota —
same as the capture-form web app already does in-browser.

src/utils/drive_api.py — _credentials() now prefers
DRIVE_OAUTH_CLIENT_ID/DRIVE_OAUTH_CLIENT_SECRET/DRIVE_OAUTH_REFRESH_TOKEN
env vars when present, falling back to the existing service-account/ADC
path otherwise. bootstrap.py/sheets_api.py are unaffected — they never
set those vars.
src/capture_tools/push_drive.py — docstring updated to describe the new
auth requirement; no logic change.
.forgejo/workflows/push-drive.yml — drops the GCP_SA_KEY step, passes
the three DRIVE_OAUTH_* secrets instead.
scripts/get_drive_refresh_token.py (new) — one-time, local-only helper
to obtain the refresh token via an interactive consent flow.

Closes #

How to test

One-time setup: create an OAuth Client ID (Desktop app type) in Cloud
Console, then locally run:
python scripts/get_drive_refresh_token.py --client-id ... --client-secret ...
signed in as the account that owns the Drive folder.
Store the three printed values as repo secrets: DRIVE_OAUTH_CLIENT_ID,
DRIVE_OAUTH_CLIENT_SECRET, DRIVE_OAUTH_REFRESH_TOKEN.
Run pytest — all existing tests should still pass unmodified (the new
credential path is additive and only activates when those env vars are
set).
Run Push provider files to Drive from Actions with dry_run checked,
confirm no auth errors.
Run it again for real and confirm new files actually appear in Drive
without a storageQuotaExceeded error.

Checklist

Tests added or updated
Docs updated if behaviour changed
No unrelated changes included
PR is focused on one thing

Release notes

Fix Drive push workflow to authenticate as the folder-owning account instead of the service account, avoiding a storage quota error.

## What changed and why Fixes a `storageQuotaExceeded` 403 in the push-drive workflow. Service accounts have zero storage quota outside a Shared Drive — they can edit files they're shared on but can't create new ones — and the target Drive folder is owned by a personal Gmail account, so Shared Drives / domain-wide delegation (both Workspace-only) weren't an option. Switches Drive uploads over to a personal-account OAuth refresh token instead, so new files are created under the folder owner's own quota — same as the capture-form web app already does in-browser. - `src/utils/drive_api.py` — `_credentials()` now prefers `DRIVE_OAUTH_CLIENT_ID`/`DRIVE_OAUTH_CLIENT_SECRET`/`DRIVE_OAUTH_REFRESH_TOKEN` env vars when present, falling back to the existing service-account/ADC path otherwise. `bootstrap.py`/`sheets_api.py` are unaffected — they never set those vars. - `src/capture_tools/push_drive.py` — docstring updated to describe the new auth requirement; no logic change. - `.forgejo/workflows/push-drive.yml` — drops the `GCP_SA_KEY` step, passes the three `DRIVE_OAUTH_*` secrets instead. - `scripts/get_drive_refresh_token.py` (new) — one-time, local-only helper to obtain the refresh token via an interactive consent flow. ## Related issues Closes # ## How to test 1. One-time setup: create an OAuth Client ID (Desktop app type) in Cloud Console, then locally run: `python scripts/get_drive_refresh_token.py --client-id ... --client-secret ...` signed in as the account that owns the Drive folder. 2. Store the three printed values as repo secrets: `DRIVE_OAUTH_CLIENT_ID`, `DRIVE_OAUTH_CLIENT_SECRET`, `DRIVE_OAUTH_REFRESH_TOKEN`. 3. Run `pytest` — all existing tests should still pass unmodified (the new credential path is additive and only activates when those env vars are set). 4. Run **Push provider files to Drive** from Actions with `dry_run` checked, confirm no auth errors. 5. Run it again for real and confirm new files actually appear in Drive without a `storageQuotaExceeded` error. ## Checklist - [x] Tests added or updated - [x] Docs updated if behaviour changed - [ ] No unrelated changes included - [x] PR is focused on one thing ## Release notes Fix Drive push workflow to authenticate as the folder-owning account instead of the service account, avoiding a storage quota error.

Xeplosion added 2 commits

2026-08-27 04:45:53 +00:00

debug: added debug step to sanity check service-account key.

CI / format (push) Successful in 7s

Details

CI / test (push) Successful in 7s

Details

Validate capture files / validate (push) Successful in 7s

Details

f86872926e

fix: use personal-account OAuth refresh token for Drive uploads, since service accounts have no storage quota outside a Shared Drive.

CI / format (push) Successful in 7s