Rather than use the --credentials and provide JSON keys, I was looking to use service account impersonation. Executing as follows:

gcloud config set auth/impersonate_service_account <sa>
dataform run
gcloud config unset auth/impersonate_service_account

However the Dataform CLI ignores the impersonation and executes using your core account.

Could we get an option to specify an impersonation account as part of the run command?