Function gcs_workload_identity_provider 

pub fn gcs_workload_identity_provider<F, S>(
    explicit: &HashMap<String, String, S>,
    env_lookup: &F,
) -> Result<Option<GcpCredentialProvider>, GcsCredentialError>
where
    F: Fn(&str) -> Option<String>,
    S: BuildHasher,

Select a refreshable credential provider when external-account ADC wins the existing explicit-over-ambient credential precedence.

Service-account key/path configuration remains owned by object_store. The returned provider lazily initializes Google’s SDK on first I/O so a synchronously constructed object store is not tied to a temporary runtime.

Errors

Returns a redacted error when the selected ADC file cannot be safely read, parsed, or classified.