ok worked around it by falling backing to the service account key json, i know it isn't the most secure but it took 5 seconds to setup and it worked... i think the docs for the gcloud oidc integration need to be updated, some things changed and they no longer work

@fierce-pizza-25506 try double checking the information you entered in the Pulumi console (project number, workload pool ID, identity provider ID, and region - defaults to global). You'll get this error if those are incorrect. It's confusing but this is actually a higher level token that has an incorrect audience, not the one where your org will be the subject. Pulumi generates this higher level token audience in the format described here based on what you enter in the fields in Pulumi.

ok i will try it agian, thanks