Should I use the Workload Identity Federation for such use case

[Salvo]

I have the following scenario.

Github Actions self-hosted running in GKE. The pods spawn have a k8s Service Account with an annotation pointing to IAM Service Account.

I need to use a Github action https://github.com/FirebaseExtended/action-hosting-deploy which unfortunately requires to have a Service Account credentials passed as a JSON.

Running on GKE I find insecure to have a JSON and I could leverage Workload Identity to increase the security.

Now I'm confused whether I must use Workload Identity Federation (and hence create a pool, etc) or I can generate somehow a JSON service token on-fly and pass it to the github action