You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We tried Google Drive as a place to push the sanitized database to, and fetch it back from, in PR #3306. It works, but the setup is too heavy for what it's meant to be, so it's parked here and the PR now pushes to FTP and S3 instead. Here's what we learned, so whoever picks this up doesn't start from zero.
What was built
The full implementation lives in the history of PR #3306, at commit afd4b02:
vortex-fetch-db-gdrive: signs a JWT (RS256) for a Google Cloud service account with php -r and openssl_sign, swaps it for an OAuth access token, finds the dump by name in a folder (files.list with supportsAllDrives=true) and downloads it with alt=media. It supports VORTEX_DB_INDEX.
vortex-push-db-gdrive: same sign-in. It uploads through a resumable session in a single PUT, so dumps aren't capped by the 5 MB multipart limit, and replaces a same-named file in place (PATCH), so the file ID and sharing stay put.
BATS suites that sign a real JWT with a key generated per test, plus try-fetch-db-gdrive.sh and try-push-db-gdrive.sh playground scripts.
Why it's parked
There's no way to reach the Drive API without credentials, and Google only issues those through a Cloud project. Each sign-in option has a catch:
Service account key (what was built): service accounts have no storage of their own, so they can only create files in a shared drive. That needs Google Workspace, and on organisations created since May 2024 the iam.disableServiceAccountKeyCreation policy blocks key creation until an admin overrides it. Workspace also treats *.iam.gserviceaccount.com addresses as external, so the shared drive has to allow outside members.
OAuth refresh token of a dedicated account: this works with a plain shared folder in that account's My Drive, with no Workspace and no shared drive. It still needs a free personal Cloud project, an OAuth client and a one-time consent, for example through the OAuth Playground. The app has to be In production, because "Testing" mode expires refresh tokens after 7 days. Anyone holding the token has full access to that account's Drive.
Email and password: not possible. Google has switched off password sign-in for third-party apps, and App Passwords don't cover Drive.
Other things to watch for:
A free account's 15 GB fills up fast once old copies are kept.
On GitHub Actions the JSON key secret has to be single-line (jq -c . key.json), because the workflow copies env into $GITHUB_ENV line by line.
If we pick it up again
The least friction is probably the OAuth refresh token of a dedicated account, with the folder shared as Viewer to a read-only service account for developers' fetches. Service accounts can read from a normal shared folder. A similar option is Google Cloud Storage through its S3-compatible API, which would only need an endpoint variable on the S3 scripts. It also needs a Cloud project, though.
Activity
25 remaining items
AlexSkrypnyk commentedon Nov 11, 2026
Postponed
We tried Google Drive as a place to push the sanitized database to, and fetch it back from, in PR #3306. It works, but the setup is too heavy for what it's meant to be, so it's parked here and the PR now pushes to FTP and S3 instead. Here's what we learned, so whoever picks this up doesn't start from zero.
What was built
The full implementation lives in the history of PR #3306, at commit afd4b02:
vortex-fetch-db-gdrive: signs a JWT (RS256) for a Google Cloud service account withphp -randopenssl_sign, swaps it for an OAuth access token, finds the dump by name in a folder (files.listwithsupportsAllDrives=true) and downloads it withalt=media. It supportsVORTEX_DB_INDEX.vortex-push-db-gdrive: same sign-in. It uploads through a resumable session in a singlePUT, so dumps aren't capped by the 5 MB multipart limit, and replaces a same-named file in place (PATCH), so the file ID and sharing stay put.try-fetch-db-gdrive.shandtry-push-db-gdrive.shplayground scripts.Why it's parked
There's no way to reach the Drive API without credentials, and Google only issues those through a Cloud project. Each sign-in option has a catch:
iam.disableServiceAccountKeyCreationpolicy blocks key creation until an admin overrides it. Workspace also treats*.iam.gserviceaccount.comaddresses as external, so the shared drive has to allow outside members.Other things to watch for:
jq -c . key.json), because the workflow copiesenvinto$GITHUB_ENVline by line.If we pick it up again
The least friction is probably the OAuth refresh token of a dedicated account, with the folder shared as Viewer to a read-only service account for developers' fetches. Service accounts can read from a normal shared folder. A similar option is Google Cloud Storage through its S3-compatible API, which would only need an endpoint variable on the S3 scripts. It also needs a Cloud project, though.
[#154] Added Google Drive database fetch and push scripts and the 'vo…
[#154] Fixed mock expectations in the Google Drive and refresh tests.
[#154] Documented pushing the sanitized database to a Google Drive or…
[#154] Fetched the dump from the upstream source in 'vortex-fetch-db'…
[#154] Narrowed the fetch-db upstream source failure assertion.
[#154] Regenerated the variables reference.