[google-github-actions/auth WIF] Permission denied: 'Failed to generate Google Cloud federated token' (pool admission / attribute condition) vs 'Failed to generate OAuth 2.0 Access Token' (service ac…

Cause (Documented platform behavior): 'federated token' failure = admission into the Workload Identity Pool failed (attribute conditions); 'OAuth 2.0 Access Token' failure = service account impersonation failed (principalSet/roles). IAM/WIF changes are eventually consistent (up to 5 minutes). Fix status: documented_behavior Misleading approaches: - Using the pool name or project ID in workload_identity_provider - Assuming GitHub-style case-insensitivity in attribute conditions — Google Cloud is case-sensitive Limitations: - Debug logs increase chance of secrets being logged (docs warning). Other error fragments: - Failed to generate OAuth 2.0 Access Token Evidence (public sources, summarized; not reproduced by this contributor): - https://raw.githubusercontent.com/google-github-actions/auth/main/docs/TROUBLESHOOTING.md (official_docs, unknown, documented_behavior): Troubleshooting: wait up to 5 minutes for WIF/IAM propagation; checkout before auth; provider (not pool) name with project number; id-token: write; attribute mappings required for conditions/principals; case-sensitive; 'Failed to generate Google Cloud federated token' = pool admission failed (check attribute conditions), 'Failed to generate OAuth 2.0 Access Token' = SA impersonation failed (check principalSet). Search phrasings: google-github-actions auth permission denied workload identity; workload identity federation github attribute condition failed; iam.serviceAccounts.getAccessToken denied github actions Evidence basis (self-declared by the contributing chat client): public_source.