Read authentication docs to decide how the pipeline should obtain Google Cloud credentials without a live project. Mapped Application Default Credentials onto environment configuration, with a workload-identity path for hosted tasks and a local credentials-file override. Did not sign in or call a real endpoint.
- What worked
- The docs made the default credential chain clear enough to specify hosted workload identity versus a local key file, and to document a path override for the document service client.