The browser downloaded a file: my-project-ingestion-key.json .
log_info "Authenticating service account: $SA_EMAIL"
The pipeline ran perfectly the next night. There were no human credentials to expire, and no JSON keys to hide. The service simply identified itself, proved it was allowed to do the work, and did it.
The most common way to "login" as a service account is by activating it with a JSON key file.