How can I login to azcopy on Github Actions with an OIDC Federated Identity?

I have succesfully logged into Azure on a Github Actions workflow using an OpenID Connect Federated Identity credential. This Service Principal works across two subscriptions in the same tenant:

      - name: Azure login with OIDC
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          environment: "AzureCloud"
          allow-no-subscriptions: true

However, I'd ultimately like to use this login with azcopy. We had previously used a SAS token, which worked, but we have a growing team and we want to make things more resilient by having a credential that doesn't have to rotate and won't be exposed to many different eyes.

The following code does not work:

      - name: Azure login with OIDC
        uses: azure/login@v2
        env:
            AZCOPY_AUTO_LOGIN_TYPE: SPN
            AZCOPY_SPA_APPLICATION_ID: ${{ secrets.CLIENT_ID }}
            AZCOPY_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        with:
          client-id: ${{ secrets.CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          environment: "AzureCloud"
          allow-no-subscriptions: true

      - name: Check azcopy login status
        env:
          AZCOPY_AUTO_LOGIN_TYPE: SPN # I've also tried AZCLI
          AZCOPY_SPA_APPLICATION_ID: ${{ secrets.CLIENT_ID }}
          AZCOPY_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        run: |
            azcopy login status --tenant --endpoint

While the first step runs just fine, azcopy login status returns with an error:

How might I authenticate to azcopy after succesfully authenticating to az?

Some success criteria I am looking for:

• I should be able to use azcopy login status before attempting an actual azcopy operation to confirm that I am logged in.
• I should ultimately be able to use my OIDC-enabled Service Principal in Github Actions, but a proof of concept using a client-secret or certificate locally, perhaps without Github Actions, would be helpful too. As such I am not married to the idea of using the Azure Login action, I'd be happy to swap to the az cli if that's more reliable. I would just from there want a good explanation of how I'd convert this local workflow to Github Actions.

I was very close originally. Thanks to this blog post by Tim Jacomb I was able to login to azcopy with an OIDC federated identity:
https://blog.timja.dev/using-azcopy-in-github-actions-with-federated-credentials/

Summary:
Making use of azcopy's auto-login, afaik, is the only way to use OIDC credentials when using azcopy with a Service Principal.
- The azcopy cli allows for various methods of authenticating via Service Principal, but OIDC is not one of them.
- The az cli as well as the Azure Login action, however, DO work with OIDC, and thus you need to first login with one of those and then auto-login to azcopy using environment variables and your target azcopy command.

Summary of modifications:
- I had other issues offscreen that were causing the AZCLI option for AZCOPY_AUTO_LOGIN_TYPE to not work. This is indeed the correct flag.
- allow-no-subscriptions: true when logging into az does not work with azcopy, as far as I can tell. I've removed that and replaced it with the subscription id for the resources with which I'm going to use the Service Principal.
- Only set the environment variables on the step you're going to use them.

- name: Azure login with OIDC
  uses: azure/login@v2
  with:
    client-id: ${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: ${{ secrets.AZURE_TENANT_ID }}
    subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

- name: Copy file to Azure Blob Storage
   env:
      AZURE_STORAGE_ACCOUNT: your-storage-account-name
      AZURE_CONTAINER_NAME: example
      AZCOPY_AUTO_LOGIN_TYPE: AZCLI # This is the auto login type you want
      AZCOPY_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} # Don't forget this
   run: |
      echo ""
      azcopy sync "." "https://$AZURE_STORAGE_ACCOUNT.file.core.windows.net/$AZURE_CONTAINER_NAME/"