Three Errors You Actually Hit Connecting Actions to GCP

Conclusion Workload Identity Federation failures come from the configuration living in three layers. The error text does not tell you which one. GitHub Actions side — does the job have id-token: write ? Pool side — does attribute_condition permit the calling repository? Service account side — is the roles/iam.workloadIdentityUser binding still there? Any of the three missing produces similar…