A CI job runs outside Google Cloud and can present a trusted external identity token. It needs short-lived Google Cloud access without storing a service-account key. Which approach best fits?

1. Grant narrowly scoped service-account impersonation permissions and use short-lived credentials.
2. Use Workload Identity Federation with appropriately scoped trust and IAM grants.
3. Attach a least-privilege service account and use application default credentials.
4. Use Workload Identity Federation for GKE with per-workload grants.