A CI workload runs outside Google Cloud and can present a trusted repository identity token. It must deploy only one approved project without storing long-lived Google credentials. Which two design choices meet these requirements? Select 2 answers.

1. Store a service-account private key in the repository secret store as the primary identity path.
2. Grant project Owner to every identity from the external provider.
3. Restrict trusted token attributes and grant only the required deployment permissions.
4. Use workforce federation as a replacement for the software workload identity.
5. Use Workload Identity Federation for short-lived access.