Workload identity is preferred in CI instead of GOOGLE_APPLICATION_CREDENTIALS Signed-off-by: Chao Dai <chaodai@google.com>