auth: implement a passwordless authentication flow with OIDC

[everspader]

Would it be possible to implement a passwordless authentication flow with OIDC, for example using Azure AD, where there is no need to provide a client secret and worry about managing and rotating the secrets?
For example, GitHub Actions provide this type of workflow where only subscription, tenant and client IDs are required to enable the workflows to access Azure resources.

I am no expert in authentication but thinking out loud here, I understand that this flow would require an OIDC provider from ArgoCD which in itself is deployed in an Azure resource already so could make things complicated.
Reference: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-azure

I would like to better understand the flow and the feasibility of such feature.