Use Entra credential for symbol upload, removing dnceng-symbol-server-pat#16688
Conversation
…-pat dependency When TempSymbolsAzureDevOpsOrgToken is not provided, use DefaultIdentityTokenCredential (the same credential already used for symbol promotion) instead of PATCredential for symbol uploads. This enables the pipeline to use the AzureCLI@2 task's federated identity (maestro-build-promotion) for symbol management, eliminating the need for the dnceng-symbol-server-pat PAT. - PublishArtifactsInManifestBase.cs: Fall back to DefaultIdentityTokenCredential when TempSymbolsAzureDevOpsOrgToken is empty/null; retain PATCredential for backward compat - publish.yml: Remove DotNet-Symbol-Server-Pats variable group and TempSymbolsAzureDevOpsOrgToken - publish-logs.yml: Remove dnceng-symbol-server-pat from redaction list Fixes: AB#10150
| FrozenSet<string> exclusions = LoadExclusions(symbolPublishingExclusionsFile); | ||
| PATCredential creds = new(TempSymbolsAzureDevOpsOrgToken); | ||
|
|
||
| TokenCredential creds = string.IsNullOrEmpty(TempSymbolsAzureDevOpsOrgToken) |
There was a problem hiding this comment.
I'm not positive this will work. You'll need to ensure that this identity works in the devdiv version of the pipeline.
There was a problem hiding this comment.
Verified this against the DevDiv-side setup:
eng/publishing/v3/publish.ymlruns the publish step underAzureCLI@2withazureSubscription: maestro-build-promotion.- There is a matching
maestro-build-promotionazurermservice connection in bothdnceng/internalanddevdiv/DevDiv. - Both point at the same backing app ID:
6e870007-e236-4eb1-8734-8bf8cd54c748(maestro-build-promotion-mi), and the DevDiv one isisReady=true.
So the DevDiv variant should pick up the same federated identity path as the dnceng pipeline. I also kept the code-side fallback to PATCredential when TempSymbolsAzureDevOpsOrgToken is explicitly provided, so there is still a rollout escape hatch if needed.
There was a problem hiding this comment.
I think Copilot's comment is lying, I need to do some validation here.
… regression tests (WI 10150)
|
https://dev.azure.com/dnceng/internal/_build/results?buildId=2972340&view=results has a failing promotion |
|
@missymessa This is validated and works as expected. Approve and merge when ready |
# Conflicts: # src/Microsoft.DotNet.Build.Tasks.Feed.Tests/PublishToSymbolServerTest.cs
|
I tried merging this but got:
|
5 participants
Summary
Migrates the symbol upload step in the Arcade publishing pipeline from PAT-based authentication (dnceng-symbol-server-pat) to Entra-based authentication via DefaultIdentityTokenCredential.
Changes
PublishArtifactsInManifestBase.cs
eng/publishing/v3/publish.yml
eng/common/core-templates/steps/publish-logs.yml
Context
The SymbolPublisherOptions class already accepts Azure.Core.TokenCredential -- the PATCredential was just a TokenCredential wrapper around the raw PAT string. The symbol promotion code already uses DefaultIdentityTokenCredential (Entra). This change extends the same pattern to symbol upload.
Prerequisite: The maestro-build-promotion service principal must have symbol management permissions in the dnceng org.
Fixes AB#10150