use oidc with sync action

.github/workflows/sync-data.yaml

@@ -1,4 +1,17 @@
 name: "Sync Data"
+
+# Note on authentication:
+#
+# This action uses OIDC federated credentials for authenticating with Azure.
+#
+# In Azure there is a managed identity which has been created and is set to allow federated
+# credentials from this repo when the environment is "production".
+#
+# That managed identity has been granted Storage Blob Data Contributor role to the storage account
+# which is being synced with azcopy.
+#
+# So long as those credentials are in place, this action should be able to authenticate with Azure
+# and sync data between the specified container. These permissions do not expire.
 on:
   workflow_dispatch:
     inputs:
@@ -10,7 +23,7 @@ on:
         required: true
         type: string
         default: "vX.Y"
-        
+
   workflow_call:
     inputs:
       from:
@@ -20,22 +33,34 @@ on:
         required: true
         type: string
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   sync-data:
     name: "Sync Data"
     runs-on: ubuntu-latest
+    environment: production
 
     steps:
-      # need to generate a SAS token in azure portal for the container
-      # permissions needed: Read/Add/Create/Write/Delete/List
+      - name: Azure Login
+        uses: azure/login@v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
       - name: Download azcopy
         run: |
           curl -s -L https://aka.ms/downloadazcopy-v10-linux | tar zx --strip-components 1
 
       # NOTE: storage ep should end in a /, so we do not need a slash between ep and container
       - name: Sync Data
+        env:
+          AZCOPY_AUTO_LOGIN_TYPE: AZCLI
         run: |
           echo "Syncing from ${{ inputs.from }} to ${{ inputs.to }}"
           ./azcopy sync --recursive \
-            "${{ secrets.AZ_STORAGE_EP }}${{ secrets.AZ_STORAGE_CONTAINER }}/${{ inputs.from }}/?${{ secrets.AZ_STORAGE_SAS }}" \
-            "${{ secrets.AZ_STORAGE_EP }}${{ secrets.AZ_STORAGE_CONTAINER }}/${{ inputs.to }}/?${{ secrets.AZ_STORAGE_SAS }}"
+            "${{ secrets.AZ_STORAGE_EP }}${{ secrets.AZ_STORAGE_CONTAINER }}/${{ inputs.from }}" \
+            "${{ secrets.AZ_STORAGE_EP }}${{ secrets.AZ_STORAGE_CONTAINER }}/${{ inputs.to }}"