What problem does it solve? Setting up a new repository against a multi-project GCP environment normally involves juggling service account keys, conflicting global ADC files, and confusing CLI-versus-SDK authentication paths. This Skill automates keyless impersonation-based setup so that simply running cd into a repository activates the correct GCP identity for both gcloud/bq CLI and Node/Python SDKs. ## Core Features & Use Cases - Keyless Service Account Setup: Creates a service account, grants minimal IAM roles (BigQuery, GCS, Vertex AI), and configures TokenCreator impersonation without storing SA keys on disk. - Per-Repo ADC Isolation: Generates a dedicated ADC file per repository and wires it through .mise.toml via GOOGLE_APPLICATION_CREDENTIALS, preventing cross-repo credential collisions. - Re-authentication Recovery: Provides re-auth.sh and refresh_adc.sh to recover from RAPT/refresh_token expiry and regenerate all per-repo ADCs in one command, with optional Google Ads OAuth renewal. - Use Case: You create a new repo effectuation_score that must query BigQuery in the innovation-score project. The Skill creates the SA, grants roles, writes .mise.toml, generates the per-repo ADC, and verifies both CLI and SDK run as the service account. ## Quick Start Ask the assistant to set up the repository with its GCP project, for example: set up the effectuation_score repository with the innovation-score GCP project using keyless impersonation.
