Breaking and Hardening Azure Workload Identities: From Long-Lived Secrets to GitHub OIDC Federation

Replacing a client secret with OIDC does not automatically give you least privilege. It solves one important problem: How does the workload authenticate? It does not automatically solve another equa