DVC Google Drive remote authentication failure in CI

A DVC gdrive remote defaults to an interactive browser OAuth flow, which cannot complete on a headless CI runner. The job hangs or fails asking to authenticate. In CI you must use a service account passed through GDRIVE_CREDENTIALS_DATA.

What this error means

dvc pull with a gdrive remote fails or blocks with a Google authentication prompt, "Failed to authenticate", or a request to visit an OAuth URL that no one can complete in CI.

dvc

ERROR: failed to pull data from the cloud - unable to authenticate to Google Drive:
Authentication has failed

Common causes

Interactive OAuth cannot run headless

The default gdrive flow opens a browser for consent; a CI runner has no browser, so authentication never completes.

No service account credentials provided

The remote was not configured to use a service account, and GDRIVE_CREDENTIALS_DATA is unset, so DVC has no non-interactive way to authenticate.

How to fix it

Use a service account via GDRIVE_CREDENTIALS_DATA

Create a Google service account and share the Drive folder with it.
Enable service-account mode on the remote.
Pass the JSON key through the GDRIVE_CREDENTIALS_DATA env from a secret.

Terminal

dvc remote modify storage gdrive_use_service_account true

Inject the JSON key as a secret

Provide the service-account JSON in the environment so DVC authenticates without a browser.

.github/workflows/ci.yml

- name: Pull data
  env:
    GDRIVE_CREDENTIALS_DATA: ${{ secrets.GDRIVE_CREDENTIALS_DATA }}
  run: dvc pull

How to prevent it

Always configure gdrive remotes with a service account for CI.
Keep the service-account JSON in a CI secret, never committed.
Share the target Drive folder with the service account email up front.