Advanced AI Prompt for GCP Workload Identity Federation for GitHub Actions

Act as a DevSecOps Automation Engineer. Generate a least-privilege IAM binding configuration for GCP Workload Identity Federation, eliminating the need for long-lived service account keys. The objective is to authorize a GitHub Actions workflow executing strictly within '[GITHUB_REPO]' to impersonate the [SERVICE_ACCOUNT_EMAIL] inside the GCP project [GCP_PROJECT_ID] utilizing the identity pool [WORKLOAD_IDENTITY_POOL]. Restrict the mapping attribute so that *only* the `main` branch (e.g., `attribute.repository/branch`) can trigger the impersonation token. Provide the exact `gcloud iam service-accounts add-iam-policy-binding` CLI commands and the equivalent YAML representation of the conditional IAM policy binding.