code: func SelectBestMethod(ctx context.Context, opts Options) Method {
  	// Asked to use JSON private key.
  	if opts.ServiceAccountJSONPath != "" || len(opts.ServiceAccountJSON) != 0 {
  		if opts.ServiceAccountJSONPath == GCEServiceAccount {
  			return GCEMetadataMethod
  		}
  		return ServiceAccountMethod
  	}
  
  	// Have a local auth server and an account we are allowed to pick by default.
  	// If no default account is given, don't automatically pick up this method.
  	if la := lucictx.GetLocalAuth(ctx); la != nil && la.DefaultAccountID != "" {
  		return LUCIContextMethod
  	}
  
  	// Running on GCE and callers are fine with automagically picking up GCE
  	// metadata server.
  	if opts.GCEAllowAsDefault && metadata.OnGCE() {
  		return GCEMetadataMethod
  	}
  
  	return UserCredentialsMethod
  }
docs: // SelectBestMethod returns a most appropriate authentication method for the
  // given set of options and the current execution environment.
  //
  // Invoked by Authenticator if AutoSelectMethod is passed as Method in Options.
  // It picks the first applicable method in this order:
  //   * ServiceAccountMethod (if the service account private key is configured).
  //   * LUCIContextMethod (if running inside LUCI_CONTEXT with an auth server).
  //   * GCEMetadataMethod (if running on GCE and GCEAllowAsDefault is true).
  //   * UserCredentialsMethod (if no other method applies).
  //
  // Beware: it may do relatively heavy calls on first usage (to detect GCE
  // environment). Fast after that.