I followed the steps given at for the Direct Workload Identity Federation.

My yaml file includes:

- uses: 'google-github-actions/auth@v2'
  with:
    project_id: 'my-project'
    workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/github/providers/providerID'

In my Github Runner I successfully see:

Run google-github-actions/auth@v2
Created credentials file at "/home/runner/work/repo/repo/gha-creds-1234.json"

I am successfully able to create a NewKeyManagementClient since it does not error out using:

client, err = kms.NewKeyManagementClient(ctx)

While setting up I granted access to kms keyrings using:

gcloud kms keyrings add-iam-policy-binding  "test" 
--location="global" 
  --project="my-project" 
  --role="roles/cloudkms.admin" 
  --member="principalSet://iam.googleapis.com/projects/123456789/locations/global/workloadIdentityPools/github/attribute.repository/my-org/my-github-repo" 

my-github-repo is my actual Github Repo name. This is different from providerID present in the yaml. My actual repo name is only 3 letters long and GCP does not allow me to set it as the OIDC Provider value (I see nothing on the docs to suggest these have to be the same value as well).

And after performing gcloud kms keyrings get-iam-policy test --location=global

I successfully see this IAM present.
However, I see this error in the Github CI at a later stage

rpc error: code = PermissionDenied desc = Permission 'cloudkms.keyRings.list' denied on resource 'projects/***/locations/***' (or it may not exist)

In my google console for my provider, I see the Attribute Conditions as

assertion.repository_owner == 'my-org'

Where am I going wrong?