domain-skills: Google Cloud service accounts + Sheets sharing/API

[laszlolm]

Adds two domain skills learned while setting up a service-account-backed Sheets integration end-to-end through the browser:

• google-cloud/service-accounts.md — deep links that skip all console navigation (API enable, SA create, keys page), the silent JSON key download, and the "share the doc, no IAM roles needed" shortcut.
• google-sheets/sharing-and-api.md — the share dialog flow including the Workspace external-share double-confirm trap, the stray-click-into-cell-edit trap, plus API-first patterns: reading dropdown validation options without clicking, and row-level developer metadata for tracking rows that humans re-sort.

🤖 Generated with Claude Code

---

Summary by cubic

Adds two domain-skills docs to streamline a service-account–backed Google Sheets integration. Includes deep links, common sharing traps, and API-first patterns to make setup faster and less flaky.

• New Features
  • domain-skills/google-cloud/service-accounts.md: Deep links for API enable, SA create, and keys; tips on reusing ?project, capturing SA email, using “Create and close,” JSON key auto-download path; clarify that Sheets/Drive access works by sharing the doc with the SA email (no IAM roles).
  • domain-skills/google-sheets/sharing-and-api.md: Share flow with Workspace external-share double confirm; avoid stray cell edit after closing the dialog; prefer Sheets v4 API over DOM; examples for reading data validation options and using row-level developer metadata for stable row tracking; note on the account sign-in wall.

^{Written for commit 534c82b. Summary will update on new commits.}

[browser-harness-review]

✅ Skill review passed

Reviewed 2 file(s) — no findings.

[cubic-dev-ai]

2 issues found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="domain-skills/google-cloud/service-accounts.md">

<violation number="1" location="domain-skills/google-cloud/service-accounts.md:1">
P2: The title says 'service accounts & API keys', but the document only covers service accounts and service account keys. In Google Cloud, API keys and service account keys are distinct credential types, and conflating them in the title can mislead readers into looking for the wrong credential type. Consider updating the title to something like `# Google Cloud Console — service accounts & service account keys` to match the content.</violation>

<violation number="2" location="domain-skills/google-cloud/service-accounts.md:15">
P2: The document currently recommends sharing Sheets/Drive documents with the service account as Editor without any qualification about the actual access needed. For read-only integrations (such as reading dropdown validation via the API), Editor is broader than necessary and violates least-privilege practice. Since this document is a copy-paste-ready domain-skills guide, consider qualifying the recommendation so readers match the share role (Viewer, Commenter, or Editor) to the operations the integration actually performs.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: The title says 'service accounts & API keys', but the document only covers service accounts and service account keys. In Google Cloud, API keys and service account keys are distinct credential types, and conflating them in the title can mislead readers into looking for the wrong credential type. Consider updating the title to something like # Google Cloud Console — service accounts & service account keys to match the content.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At domain-skills/google-cloud/service-accounts.md, line 1:

<comment>The title says 'service accounts & API keys', but the document only covers service accounts and service account keys. In Google Cloud, API keys and service account keys are distinct credential types, and conflating them in the title can mislead readers into looking for the wrong credential type. Consider updating the title to something like `# Google Cloud Console — service accounts & service account keys` to match the content.</comment>

<file context>
@@ -0,0 +1,15 @@
+# Google Cloud Console — service accounts & API keys
+
+## Deep links (skip all menu navigation)
</file context>

Suggested change

	# Google Cloud Console — service accounts & API keys
	# Google Cloud Console — service accounts & service account keys

[cubic-dev-ai]

P2: The document currently recommends sharing Sheets/Drive documents with the service account as Editor without any qualification about the actual access needed. For read-only integrations (such as reading dropdown validation via the API), Editor is broader than necessary and violates least-privilege practice. Since this document is a copy-paste-ready domain-skills guide, consider qualifying the recommendation so readers match the share role (Viewer, Commenter, or Editor) to the operations the integration actually performs.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At domain-skills/google-cloud/service-accounts.md, line 15:

<comment>The document currently recommends sharing Sheets/Drive documents with the service account as Editor without any qualification about the actual access needed. For read-only integrations (such as reading dropdown validation via the API), Editor is broader than necessary and violates least-privilege practice. Since this document is a copy-paste-ready domain-skills guide, consider qualifying the recommendation so readers match the share role (Viewer, Commenter, or Editor) to the operations the integration actually performs.</comment>

<file context>
@@ -0,0 +1,15 @@
+- SA creation: typing the display name auto-fills the account ID; the resulting email is shown live under the ID field (`<id>@<project>.iam.gserviceaccount.com`). Grab it from there — you need it to share resources with the SA.
+- "Create and close" (skip steps 2–3) is enough when access will be granted by sharing a resource (e.g. a Google Sheet) rather than IAM roles.
+- Key creation: Add key → Create new key → JSON (preselected) → Create. The JSON downloads silently to `~/Downloads/<project>-<hex>.json` — no save dialog. Poll `ls -t ~/Downloads/<project>-*.json`.
+- Sheets/Drive access for an SA needs NO project roles: just share the document with the SA's email as Editor. The SA can't accept invites; sharing is enough.
</file context>