Transition to GitHub App auth, remove azuresdk-github-pat usage#49049
Open
scbedd wants to merge 1 commit into
Open
Transition to GitHub App auth, remove azuresdk-github-pat usage#49049scbedd wants to merge 1 commit into
scbedd wants to merge 1 commit into
Conversation
chidozieononiwu
requested review from
ArthurMa1978,
XiaofeiCao,
benbp,
danieljurek,
haolingdong-msft,
mikeharder,
raych1 and
weidongxu-microsoft
as code owners
Contributor
There was a problem hiding this comment.
Pull request overview
This PR aims to transition Azure DevOps pipeline automation away from the azuresdk-github-pat secret toward GitHub App-based authentication by standardizing an AuthToken parameter on shared pipeline steps and updating patch-release branch push authentication.
Changes:
- Adds
AuthToken: ''to several pipeline/template invocations to make token passing explicit and consistent. - Updates patch release branch push to use a GitHub App installation token (
GH_TOKEN) and adds alogin-to-github.ymlstep before the push. - Propagates the new
AuthTokenparameter into generation, docindex, prepare-pipelines, and release archetype templates.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 20 comments.
Show a summary per file
| File | Description |
|---|---|
| eng/pipelines/templates/stages/archetype-java-release-pom-only.yml | Adds AuthToken: '' to the GitHub release/tagging step invocation. |
| eng/pipelines/templates/stages/archetype-java-release-patch.yml | Adds AuthToken: '' to GitHub release/tagging and PR creation step invocations. |
| eng/pipelines/templates/stages/archetype-java-release-batch.yml | Adds AuthToken: '' to GitHub release/tagging and PR creation step invocations. |
| eng/pipelines/prepare-pipelines.yml | Passes AuthToken: '' into the shared prepare-pipelines job template. |
| eng/pipelines/patch-release-prepare.yml | Adds GitHub login step and switches git push URL to use GH_TOKEN; also passes AuthToken: '' to PR creation. |
| eng/pipelines/docindex.yml | Passes AuthToken: '' into git push steps for docs repo updates. |
| eng/automation/generation.yml | Passes AuthToken: '' into PR creation for automation-generated changes. |
| ArtifactLocation: $(Pipeline.Workspace)/packages-signed/${{artifact.groupId}}/${{artifact.name}} | ||
| PackageRepository: Maven | ||
| ReleaseSha: $(Build.SourceVersion) | ||
| AuthToken: '' |
| ArtifactLocation: $(Pipeline.Workspace)/packages-signed/${{artifact.groupId}}/${{artifact.name}} | ||
| PackageRepository: Maven | ||
| ReleaseSha: $(Build.SourceVersion) | ||
| AuthToken: '' |
| CommitMsg: "Increment package versions for patch releases" | ||
| PRTitle: "Increment versions for patch releases" | ||
| CloseAfterOpenForTesting: '${{ parameters.TestPipeline }}' | ||
| AuthToken: '' |
| ArtifactLocation: $(Pipeline.Workspace)/packages-signed/${{artifact.groupId}}/${{artifact.name}} | ||
| PackageRepository: Maven | ||
| ReleaseSha: $(Build.SourceVersion) | ||
| AuthToken: '' |
| CommitMsg: "Increment package versions for ${{ parameters.ServiceDirectory }} releases" | ||
| PRTitle: "Increment versions for ${{ parameters.ServiceDirectory }} releases" | ||
| CloseAfterOpenForTesting: '${{ parameters.TestPipeline }}' | ||
| AuthToken: '' |
| template: /eng/common/pipelines/templates/jobs/prepare-pipelines.yml | ||
| parameters: | ||
| Repository: Azure/azure-sdk-for-java | ||
| AuthToken: '' |
| PROwner: Azure | ||
| CommitMsg: "Patch release preparation $(PatchDate)" | ||
| PRTitle: "Prepare patch release $(PatchDate)" | ||
| AuthToken: '' |
| TargetRepoName: $(DocRepoName) | ||
| TargetRepoOwner: $(DocRepoOwner) | ||
| WorkingDirectory: $(DocRepoLocation) | ||
| AuthToken: '' |
| WorkingDirectory: $(DocRepoLocation) | ||
| ScriptDirectory: $(Build.SourcesDirectory)/eng/common/scripts | ||
| PushArgs: -f | ||
| AuthToken: '' |
| PRTitle: '[Automation] Generate Fluent Lite from Swagger $(README)#$(TAG)' | ||
| PRLabels: 'Mgmt - Track 2' | ||
| OpenAsDraft: '$(DRAFT_PULL_REQUEST)' | ||
| AuthToken: '' |
Related to Azure/azure-sdk-tools#9842 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
chidozieononiwu
force-pushed
the
RemoveAzsdkPatUsage
branch
from
5f230df to
2a77579
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request updates multiple Azure pipeline YAML files to explicitly set the
AuthTokenparameter (usually as an empty string) in various pipeline steps and templates. Additionally, it updates the Git URL used for pushing release branches to use a different authentication method and adds a login step before pushing branches. These changes are primarily aimed at improving authentication handling and consistency across pipeline automation.Authentication and Token Handling:
AuthToken: ''to various pipeline steps and templates in files such aseng/automation/generation.yml,eng/pipelines/docindex.yml,eng/pipelines/prepare-pipelines.yml, and multiple archetype release batch/patch templates. This ensures that theAuthTokenparameter is always defined, which can help prevent errors related to missing authentication tokens. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]Pipeline Security and Git Operations:
GH_TOKENwith thex-access-tokenauthentication method instead of the previous PAT variable, improving security and standardization.Related to Azure/azure-sdk-tools#9842