build: use OIDC flow for docs publish

Author: erickzhao

.github/workflows/docs.yml

@@ -1,32 +1,35 @@
-name: Publish API documentation
+name: Publish documentation
 
 on:
   push:
     tags:
       - v[0-9]+.[0-9]+.[0-9]+*
 
-permissions: {}
+permissions:
+      id-token: write
+      contents: read
 
 jobs:
   docs:
-    runs-on: ubuntu-24
-    environment: 
-      name: publish-docs
+    runs-on: ubuntu-latest
+    environment: docs-publish
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # tag: v4.2.2
       - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a  # tag: v4.2.0
         with:
-          node-version: lts/*
+          node-version: 22.12.x
       - name: Install dependencies
         run: yarn --frozen-lockfile
       - name: Build API documentation
         run: yarn build:docs
+      - name: Azure login
+        uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2.2.0
+        with:
+          client-id: ${{ secrets.AZURE_OIDC_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_OIDC_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_OIDC_SUBSCRIPTION_ID }}
       - name: Upload to Azure Blob Storage
         uses: azure/cli@089eac9d8cc39f5d003e94f8b65efc51076c9cbd  # tag: v2.1.0
         with:
-          azcliversion: latest
           inlineScript: |
-            az storage blob upload-batch --account-name $ACCOUNT_NAME -d '$web/notarize/${{ github.ref_name }}' -s ./docs --overwrite --sas-token "$SAS_TOKEN"
-        env:
-          SAS_TOKEN: ${{ secrets.SAS_TOKEN }}
-          ACCOUNT_NAME: ${{ secrets.ACCOUNT_NAME }}
+            az storage blob upload-batch --account-name ${{ secrets.AZURE_ECOSYSTEM_PACKAGES_STORAGE_ACCOUNT_NAME }} -d '$web/notarize/${{ github.ref_name }}' -s ./docs --overwrite --auth-mode login