From acd64b3562b78225ce43e405ca458da978f91e98 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Thu, 15 Oct 2026 12:09:03 +0000
Subject: [PATCH] =?UTF-8?q?feat:=20implement=20issue=20#607=20=E2=80=94=20?=
 =?UTF-8?q?[Fleet=20Monitor]=20combsmith/broodly=20=E2=80=94=20.github/wor?=
 =?UTF-8?q?kflows/ci.yml?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 infra/terraform/GCP_SETUP.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/infra/terraform/GCP_SETUP.md b/infra/terraform/GCP_SETUP.md
index c66db1bb..9d450985 100644
--- a/infra/terraform/GCP_SETUP.md
+++ b/infra/terraform/GCP_SETUP.md
@@ -11,6 +11,19 @@ This document records the one-time GCP configuration steps that cannot be automa
 
 These steps allow GitHub Actions to authenticate to GCP without service account keys.
 
+### 1.0 Enable Required APIs
+
+```bash
+gcloud services enable \
+  iam.googleapis.com \
+  iamcredentials.googleapis.com \
+  sts.googleapis.com \
+  artifactregistry.googleapis.com \
+  --project="broodly-491920"
+```
+
+> **Note:** `iamcredentials.googleapis.com` is required for the WIF provider to impersonate `broodly-ci`. Without it, `google-github-actions/auth` succeeds but `docker push` fails with `IAM Service Account Credentials API has not been used in project 922040293304 before or it is disabled`.
+
 ### 1.1 Create CI Service Account
 
 ```bash