How does OIDC keyless authentication improve CI/CD security?

GitHub Actions generates a short-lived JWT token per workflow run that cloud providers exchange for temporary credentials scoped to that run. No long-lived access keys are stored in secrets, eliminating persistent credentials that can be leaked or misused after the pipeline is decommissioned.