Takeaway: If it works locally but not in CI, suspect credentials—not code.
Local environments often have cached credentials or broader permissions that CI runners do not.
In CI, authentication must be explicit. Missing environment variables, incorrect service account bindings, or restrictive IAM roles commonly cause failures that don’t reproduce locally.
Log the identity being used inside the pipeline and verify it matches what you expect. For cloud access, always assume the CI identity is less privileged than your local one.