Skip to content

GitHub Actions Deployment — FAQ

Common issues when deploying via GitHub Actions and the reusable SRE workflows.

unauthorized: authentication required when pushing image

You're using registry.jetbrains.team (Space registry) as your image destination. The reusable workflow only authenticates to GHCR via GITHUB_TOKEN — it has no credentials for Space.

Fix: Use GHCR as your image registry:

# skaffold.yaml
build:
  artifacts:
    - image: ghcr.io/jetbrains/<your-repo-name>

403 Forbidden when pulling Helm chart

The chart registry.jetbrains.team/p/cb/helm-charts/simple-app is in Space and not accessible from GitHub Actions.

Fix: Use the chart from GHCR:

# skaffold.yaml
deploy:
  helm:
    releases:
      - remoteChart: oci://ghcr.io/jetbrains/sre-helm-charts/simple-app
        version: 0.3.4

ServiceAccount "" resource name may not be empty

applicationName is not set. {{.APPLICATION_NAME}} is a JBCC/TeamCity env var — the GitHub Actions workflow does not set it, so it expands to an empty string.

Fix: Set applicationName directly in values.yaml, not via setValueTemplates:

# values.yaml
applicationName: my-app   # must match your Cloud Console deployment name
imagePullSecret: null
containerPort: 8080

# skaffold.yaml — only IMAGE_FULLY_QUALIFIED is needed in setValueTemplates
setValueTemplates:
  image: "{{.IMAGE_FULLY_QUALIFIED}}"

Deploys to default namespace instead of mine

namespace: is not set in skaffold.yaml. Without it Helm installs into default.

Fix: Add namespace: to every Helm release in skaffold.yaml:

deploy:
  helm:
    releases:
      - name: my-app
        namespace: <your-namespace>   # your Cloud Console namespace

Where do I get service_account and workload_identity_provider?

These are generated automatically when you connect your repository in Cloud Console.

Go to Cloud Console → GitHub Integration → your repo → Workflow Config and copy the values from there.