Skip to content

Remove azsdk pat usage#47697

Open
chidozieononiwu wants to merge 2 commits into
mainfrom
RemoveAzsdkPatUsage
Open

Remove azsdk pat usage#47697
chidozieononiwu wants to merge 2 commits into
mainfrom
RemoveAzsdkPatUsage

Conversation

@chidozieononiwu

@chidozieononiwu chidozieononiwu commented Jun 26, 2026

Copy link
Copy Markdown
Member

This is adding back the changes in this PR #46709
Avoid calling /eng/common/pipelines/templates/steps/login-to-github.yml on public run.

Related to Azure/azure-sdk-tools#9842

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings June 26, 2026 21:22

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR migrates the Python SDK pipelines off the long-lived azuresdk-github-pat secret toward short-lived GitHub App installation tokens (GH_TOKEN) minted by the shared login-to-github.yml template. It centralizes and standardizes GitHub authentication across CI, live-test, weekly-analysis, release, and docs pipelines, improving security and maintainability.

Changes:

  • Replace $(azuresdk-github-pat) with $(GH_TOKEN) for TokenToUseForAuth and GH_TOKEN env vars, adding login-to-github.yml where needed (gated on -pr repos for checkout jobs).
  • Pass AuthToken: '' to PR/push/release templates so they auto-login via the GitHub App instead of defaulting to the PAT.
  • Remove now-redundant auth config (e.g., explicit TokenOwners) and rely on shared template defaults.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated no comments.

Show a summary per file
File Description
scripts/release_helper/release_helper.yml Adds login-to-github.yml; AZURESDK_BOT_TOKEN now sourced from $(GH_TOKEN).
eng/pipelines/tsp-spec-sync.yml Passes AuthToken: '' to create-pull-request.yml for auto-login.
eng/pipelines/templates/steps/verify-autorest.yml Passes AuthToken: '' to create-pull-request.yml.
eng/pipelines/templates/steps/build-package-artifacts.yml Adds login-to-github.yml for -pr builds; sparse-checkout uses $(GH_TOKEN).
eng/pipelines/templates/stages/python-analyze-weekly.yml Adds login-to-github.yml; next-* check env vars use $(GH_TOKEN).
eng/pipelines/templates/stages/archetype-python-release.yml Passes AuthToken: '' to release tag and version-increment PR templates.
eng/pipelines/templates/jobs/live.tests.yml Adds login-to-github.yml for -pr builds; sparse-checkout uses $(GH_TOKEN).
eng/pipelines/templates/jobs/ci.tests.yml Adds login-to-github.yml for -pr builds; sparse-checkout uses $(GH_TOKEN).
eng/pipelines/prepare-pipelines.yml Trailing-newline-only change (no functional impact).
eng/pipelines/docindex.yml Passes AuthToken: '' to both git-push-changes.yml calls.
eng/pipelines/conda-update-pipeline.yml Passes AuthToken: '' to create-pull-request.yml.
eng/pipelines/aggregate-reports.yml Removes explicit TokenOwners, relying on login-to-github.yml defaults.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants