Try using access token output

.github/workflows/ci.yml

@@ -25,14 +25,15 @@ jobs:
       with:
         workload_identity_provider: 'projects/569867470362/locations/global/workloadIdentityPools/github-actions/providers/github-actions'
         service_account: '[email protected]'
-
+        token_format: 'access_token'
+
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
         pip install hatch
     - name: Test with pytest
       env:
-        EE_SERVICE_ACCOUNT: ${{ secrets.EE_SERVICE_ACCOUNT }}
+        GOOGLE_ACCESS_TOKEN: ${{ steps.auth.outputs.access_token }}
       run: |
           hatch run test:all
     

tests/conftest.py

@@ -1,4 +1,5 @@
 import json
+import os
 import warnings
 from collections import UserDict
 from pathlib import Path
@@ -69,7 +70,18 @@ def pytest_sessionstart(session):
 
 
 def _init_ee_for_tests():
-    ee.Initialize()
+    # Use the Github Service Account for CI tests
+    if os.environ.get("GITHUB_ACTIONS"):
+        key_data = os.environ.get("GOOGLE_ACCESS_TOKEN")
+        project_id = json.loads(key_data).get("project_id")
+        credentials = ee.ServiceAccountCredentials(None, key_data=key_data)
+    # Use stored persistent credentials for local tests
+    else:
+        # Project should be parsed from credentials
+        project_id = None
+        credentials = "persistent"
+
+    ee.Initialize(credentials, project=project_id)
 
 
 @pytest.fixture(autouse=True)