working example

ResultStoreAPISample.java

// Using com.auth0:java-jwt:3.4.0
import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;

// Using com.google.api-client:google-api-client:1.23.0
import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;

// Using commons-io:commons-io:2.6
import org.apache.commons.io.IOUtils;

// Using com.apache.httpcomponents:http-client:4.5.6
import org.apache.http.HttpResponse;
import org.apache.http.client.HttpClient;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.util.EntityUtils;

import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.StringWriter;
import java.security.interfaces.RSAPrivateKey;
import java.util.Date;

class ResultStoreAPISample {
    static String notWorkingResultStoreAPIToken(String jsonPath, String jsonUser) throws IOException {
        GoogleCredential credential =
                GoogleCredential.fromStream(new FileInputStream(jsonPath));
        RSAPrivateKey privateKey = (RSAPrivateKey) credential.getServiceAccountPrivateKey();
        String privateKeyId = credential.getServiceAccountPrivateKeyId();

        long now = System.currentTimeMillis();
        try {
            Algorithm algorithm = Algorithm.RSA256(null, privateKey);
            String signedJwt = JWT.create()
                    .withKeyId(privateKeyId)
                    .withIssuer(jsonUser)
                    .withSubject(jsonUser)
                    // based on https://github.com/googleapis/googleapis/blob/master/google/devtools/resultstore/resultstore-service.yaml
                    // Also tried with "google.devtools.resultstore.v2.ResultStoreFileDownload"
                    .withAudience("https://resultstore.googleapis.com/google.devtools.resultstore.v2.ResultStoreDownload")
                    .withIssuedAt(new Date(now))
                    .withExpiresAt(new Date(now + 3600 * 1000L))
                    .sign(algorithm);
            return signedJwt;
        } catch (RuntimeException whatever) {
            return null;
        }
    }
    public static void main(String[] args) throws IOException {
        String apiKey = notWorkingResultStoreAPIToken("/Users/ors/Downloads/labeldex-service-account.json", "result-store-labeldex@gcb-with-custom-workers.iam.gserviceaccount.com");
        HttpClient httpClient = HttpClients.createDefault();
        String invocationId = "bf43cb81-48e3-4098-bed6-82ff8dc514a9";
        String url = "https://resultstore.googleapis.com/v2/invocations/"+ invocationId + "/targets/%2F%2Fhello-world-service%2Fsrc%2Fmain%2Fscala%2Fcom.wixpress.ecomm%3Acom.wixpress.ecomm/configuredTargets/32c69968d720b43c1357a8212b45362e/actions/build";
        HttpGet httpGet = new HttpGet(url);
        httpGet.addHeader("accept", "application/json");
        httpGet.addHeader("Authorization", "Bearer " + apiKey);
        HttpResponse resp = httpClient.execute(httpGet);
        int statusCode = resp.getStatusLine().getStatusCode();
        if (statusCode != 204) {
            try {
                InputStream in = resp.getEntity().getContent();
                StringWriter writer = new StringWriter();
                IOUtils.copy(in, writer, "UTF-8");
                String data = writer.toString();
                EntityUtils.consumeQuietly(resp.getEntity());
                System.out.println(data);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }

    }
}