play-console-service-account

Type	Skill
Plugin	awl-android · v0.0.19
Invoke	/awl-android:play-console-service-account
Tools	Bash, Read, Write, AskUserQuestion
Source	plugins/awl-android/skills/play-console-service-account/SKILL.md

When Claude uses it

Creates a per-tenant Google Play Console service account via gcloud and stores its JSON key in 1Password (AWL-App Publishing vault). Use when asked to “create a play console service account”, “new service account for <client>”, “play store publishing account”, or to set up automated Play Store publishing credentials for a tenant/client.

Trigger phrases: create a play console service account · new service account for <client> · play store publishing account

Definition

AWL uses one Google Play publishing service account per tenant/client (instead of one global SA shared across all Play Console accounts). All SAs live in the GCP project appswithlove; keys are stored in 1Password only — never on disk, never in a repo.

Convention:

• SA name: play-console-<tenant> (lowercase, e.g. play-console-selecta)
• GCP project: appswithlove
• 1Password: account appswithlove.1password.com, vault AWL-App Publishing, item Play Console Service Account - <Tenant> (category: API Credential, JSON key attached)

Instructions

1. Get the tenant name

If not given, ask the user. Derive the SA id as play-console-<tenant> (lowercase, hyphens).

2. Verify prerequisites

gcloud config get-value account
op account list

• gcloud must be authenticated with an account that can manage IAM in project appswithlove.
• op must have the appswithlove.1password.com account. If either fails, ask the user to run gcloud auth login / op signin themselves (suggest the ! prefix).

3. Create the service account

gcloud iam service-accounts create play-console-<tenant> \
  --project=appswithlove \
  --display-name="play-console-<tenant>" \
  --description="Play Store publishing for <Tenant>"

If it already exists, confirm with the user before creating a key for it.

4. Generate the JSON key — into a temp/scratchpad directory, NEVER the repo

cd <scratchpad-or-tmp-dir> && gcloud iam service-accounts keys create play-console-<tenant>.json \
  --iam-account=play-console-<tenant>@appswithlove.iam.gserviceaccount.com

Note the key ID from the output.

5. Store in 1Password

op item create \
  --category "API Credential" \
  --title "Play Console Service Account - <Tenant>" \
  --vault "AWL-App Publishing" \
  --account appswithlove.1password.com \
  "username=play-console-<tenant>@appswithlove.iam.gserviceaccount.com" \
  "notesPlain=GCP service account for automated Play Store publishing (<Tenant>). Created in GCP project 'appswithlove'. Invite this email in the <Tenant> Play Console under Users & permissions. Key ID: <key-id>" \
  "play-console-<tenant>.json[file]=<path-to-key-file>"

6. Offer to set it as a GitLab CI/CD variable

Ask the user whether the key should also be added to the tenant’s GitLab project as ANDROID_PUBLISHER_CREDENTIALS (the env var Gradle Play Publisher and our publish pipelines read). If yes, ask for the GitLab project path and run:

glab variable set ANDROID_PUBLISHER_CREDENTIALS \
  --repo <group/project> \
  --type file \
  --protected < <path-to-key-file>

• Use --type file — the JSON is multiline, so a masked plain variable won’t work.
• --protected limits it to protected branches/tags; drop it only if the publish job runs on unprotected refs.
• If the variable already exists, use glab variable update instead.

7. Delete the local key file

rm <path-to-key-file>

The only copies must be the one in 1Password (and the CI variable, if set). Verify the op item create output showed the attached file before deleting.

8. Report to the user

• The SA email: play-console-<tenant>@appswithlove.iam.gserviceaccount.com
• The 1Password item name and vault
• Whether ANDROID_PUBLISHER_CREDENTIALS was set on the GitLab project
• Remaining manual step: invite the SA email in the tenant’s Play Console → Users & permissions with release access for the relevant app(s).

Pitfalls

• Never write the key file into a git repository or leave it on disk after upload.
• The vault is AWL-App Publishing in the appswithlove 1Password account — not a personal account and not a P-<Project> vault (unless the user explicitly asks).
• Play Console access is granted by inviting the SA email — the GCP project the SA lives in is irrelevant to Play Console; do not create per-tenant GCP projects.
• Do not grant the SA any IAM roles in GCP; Play Console permissions are managed entirely in Play Console.