Which authentication method should a GitHub Actions workflow use to push to ACR without storing long-lived secrets?
- A ACR admin username and password
- B Workload identity federation with an Azure AD app registration (correct answer)
- C A repository-scoped token committed as a secret
- D The kubelet managed identity
Shortcut: OIDC workload identity federation lets GitHub Actions exchange its short-lived OIDC token for an Azure AD access token. No client secret or admin credential is stored in the repository.