GCS Workflow Identity Federation Support for GHAs

[lindseynield]

This may not be an explicit icechunk issue, but adding it here for general tracking purposes.

The google-github-actions/auth@v2 GitHub Action (https://github.com/google-github-actions/auth) returns credentials via a workload identity provider and are a external_account type: https://googleapis.dev/python/google-auth/latest/reference/google.auth.external_account.html

It seems like Icechunk (or more specifically object_store?) does not have support for this type of credential:

icechunk.IcechunkError: storage error: unknown storage error: Generic GCS error: Unable to decode service account file: unknown variant `external_account`, expected `service_account` or `authorized_user` at line 1 column 26
/opt/hostedtoolcache/Python/3.11.11/x64/lib/python3.11/site-packages/icechunk/storage.py:147: IcechunkError

There seem to be some already open issues related to supporting GCP WIF:
apache/arrow-rs#3797
pola-rs/polars#14076

It may be the case that this will need to be resolved in arrow-rs before we can use this type of GCS credential w/ Icechunk in GHAs.