Pat to GitHub apps two test 3#8843
Closed
chidozieononiwu wants to merge 6 commits into
Closed
Conversation
Switch PAT to GitHubApps Changes to Token flow
chidozieononiwu
requested review from
JeffreyCA,
RickWinter,
bwateratmsft,
danieljurek,
hemarina,
karolz-ms,
tg-msft and
vhvb1989
as code owners
🔗 Linked Issue RequiredThanks for the contribution! Please link a GitHub issue to this PR by adding |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates Azure DevOps pipeline templates to use a GH_TOKEN-based GitHub auth flow (via the existing login-to-github helper) and restructures PR commenting / extension publishing steps, plus it adds a “Test Changes” line to two READMEs.
Changes:
- Switch PR comment posting pipeline step defaults from
$(azuresdk-github-pat)to$(GH_TOKEN)and ensure pipelines log in before commenting. - Split extension publishing into separate templates for GitHub release creation and storage upload, and wire them into the extension publish stage.
- Add “Test Changes” to
cli/azd/README.mdandext/vscode/README.md.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| ext/vscode/README.md | Adds a trailing “Test Changes” line to the VS Code extension README. |
| cli/azd/README.md | Adds a trailing “Test Changes” line to the azd README. |
| eng/pipelines/templates/steps/update-prcomment.yml | Changes the default GitHub token parameter to $(GH_TOKEN) for gh calls. |
| eng/pipelines/templates/steps/publish-extension.yml | Deleted; prior combined GitHub release + storage upload step template removed. |
| eng/pipelines/templates/steps/publish-extension-storage.yml | New template that uploads extension artifacts to storage (and removes _manifest if present). |
| eng/pipelines/templates/steps/publish-extension-github-release.yml | New template that creates/releases tags and uploads release assets using GH_TOKEN. |
| eng/pipelines/templates/stages/vscode-publish-integration.yml | Splits PR commenting into its own job and logs in to GitHub before posting. |
| eng/pipelines/templates/stages/publish.yml | Splits PR commenting into its own job and logs in to GitHub before posting. |
| eng/pipelines/templates/stages/publish-extension.yml | Refactors extension publish flow into separate GH release and storage phases, plus updates registry job auth. |
| eng/common/scripts/login-to-github.ps1 | Adds optional output-variable export support and hardens installation ID lookup/parsing. |
| eng/common/pipelines/templates/steps/login-to-github.yml | Adds an ExportAsOutputVariable parameter and names the task for output-variable addressing. |
Comment on lines
14
to
+16
| - name: GitHubToken | ||
| type: string | ||
| default: $(azuresdk-github-pat) | ||
| default: $(GH_TOKEN) |
|
|
||
| [MIT](https://github.com/Azure/azure-dev/LICENSE.md) | ||
|
|
||
| Test Changes No newline at end of file |
Comment on lines
153
to
+155
| - job: Update_Registry | ||
| dependsOn: Publish_Release | ||
| dependsOn: | ||
| - Publish_Release |
Comment on lines
+10
to
+11
|
|
||
| Test Changes No newline at end of file |
jongio
reviewed
Jun 27, 2026
jongio
left a comment
jongio
left a comment
Member
There was a problem hiding this comment.
This PR migrates CI pipeline auth from a static PAT (azuresdk-github-pat) to short-lived GitHub App tokens via the existing login-to-github helper. The approach is solid: App tokens are scoped, short-lived, and auditable.
A few issues to address before this is ready:
Update_Registrystill depends onPublish_Release, which no longer exists after this refactor. This will fail YAML compilation for both nightly and manual runs.- The "Test Changes" markers in both READMEs need to be removed before merge.
- Several new/modified files are missing a trailing newline.
| - job: Update_Registry | ||
| dependsOn: Publish_Release | ||
| dependsOn: | ||
| - Publish_Release |
Member
There was a problem hiding this comment.
Update_Registry depends on Publish_Release, but that job was renamed/split in this PR. For non-nightly runs the jobs are now Create_GitHub_Release and Publish_Storage. For nightly, only Publish_Storage exists.
This will break pipeline execution in both paths. Suggested fix:
Suggested change
| - Publish_Release | |
| dependsOn: | |
| - Publish_Storage |
For non-nightly runs where Create_GitHub_Release also exists, you may want to add a conditional dependency on that job too so the registry update waits for the release to be created.
| gh release upload $(GH_RELEASE_TAG) release/* --repo $(Build.Repository.Name) | ||
| displayName: Create GitHub Release and upload artifacts | ||
| env: | ||
| GH_TOKEN: $(GH_TOKEN) No newline at end of file |
Member
There was a problem hiding this comment.
Missing trailing newline at end of file. Same issue in publish-extension-storage.yml and vscode-publish-integration.yml.
VSCode Extension Installation Instructions
|
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces minor documentation updates to both the
cli/azd/README.mdandext/vscode/README.mdfiles. The only change is the addition of a "Test Changes" note at the end of each file. No code or functional changes are included.