Automate a Google Play release from CI using Workload Identity Federation or short-lived tokens instead of a long-lived service account key

Documented steps

1. Create or reuse a publishing service account, then invite its email in Play Console > Users and permissions and grant only the release permissions the pipeline needs for the specific app.
2. Prefer Workload Identity Federation over a downloaded JSON key: create a Workload Identity Pool and Provider trusting your CI OIDC issuer (for GitHub Actions, https://token.actions.githubusercontent.com), mapping google.subject=assertion.sub.
3. Add an attribute condition that tightly scopes who can impersonate, e.g. assertion.repository_owner=='YOUR_ORG'. A loose condition lets any workflow in that issuer mint publishing tokens.
4. Grant the federated principal impersonation rights: gcloud iam service-accounts add-iam-policy-binding SA_EMAIL --role=roles/iam.workloadIdentityUser --member='principal://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/subject/SUBJECT'
5. In the CI job request id-token: write permission and use an official auth action or library with workload_identity_provider and service_account inputs, so no key file ever touches disk.
6. If federation is unavailable, mint a short-lived token via the IAM Credentials API rather than shipping the key everywhere: POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{SA_EMAIL}:generateAccessToken with body {"scope":["https://www.googleapis.com/auth/androidpublisher"],"lifetime":"3600s"}
7. The caller must hold roles/iam.serviceAccountTokenCreator on the target service account for generateAccessToken to succeed.
8. Use the returned accessToken as the Authorization: Bearer header for every Android Publisher call in the job, and note expireTime.
9. Run the whole sequence in one job so neither the token nor the editId has to persist across pipeline stages: edits.insert, bundles.upload, tracks.update, commit.
10. Let the token expire naturally at the end of its lifetime rather than caching it as a CI secret between runs.