Revert "Migrate AzDO feed publishing from PAT to Entra-based auth (#1… - #17136
Merged
Conversation
pavel-purma
approved these changes
Jul 17, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR reverts the prior change that migrated Azure DevOps (AzDO) feed publishing from PAT-based authentication to Entra-based authentication, restoring PAT-required behavior across publishing tasks and the v3 publishing pipeline.
Changes:
- Revert AzDO NuGet feed publishing to require PAT/basic auth (and remove JWT/bearer token handling in the publishing paths).
- Treat missing AzDO feed keys as an error and skip those feeds (removing the Entra fallback behavior and its associated unit test).
- Update the v3 publishing pipeline to use the existing PAT secret/“cross-org publishing” enablement instead of acquiring an Entra access token via AzureCLI.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/Microsoft.DotNet.Build.Tasks.Feed/src/PublishArtifactsInManifestBase.cs | Restores PAT/basic auth behavior for AzDO feed publishing and adjusts client creation/call sites accordingly. |
| src/Microsoft.DotNet.Build.Tasks.Feed/src/model/SetupTargetFeedConfigV3.cs | Makes AzDO feed key required (logs error + skips AzDO feeds when missing). |
| src/Microsoft.DotNet.Build.Tasks.Feed/src/AzureDevOpsNugetFeedAssetPublisher.cs | Removes Entra/JWT handling and always configures Basic auth for AzDO feed publishing. |
| src/Microsoft.DotNet.Build.Tasks.Feed.Tests/SetupTargetFeedConfigV3Tests.cs | Removes test that validated Entra fallback when AzDO feed key was missing. |
| src/Microsoft.DotNet.Arcade.Sdk/toolset/PublishArtifactsInManifest.proj | Always includes the dnceng AzDO feed key item (no condition on property being set). |
| eng/publishing/v3/publish.yml | Replaces Entra token acquisition step with cross-org publishing enablement and passes PAT secret directly as AzureDevOpsFeedsKey. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+976
to
+980
| ManagedIdentityClientId = ManagedIdentityClientId | ||
| }); | ||
| var tokenRequestContext = new global::Azure.Core.TokenRequestContext(new[] { "499b84ac-1321-427f-aa17-267ca6975798/.default" }); | ||
| var accessToken = credential.GetToken(tokenRequestContext, CancellationToken.None); | ||
| client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken.Token); |
|
|
||
| // If no key is specified for AzDo NuGet feeds, the publisher will attempt to fall | ||
| // back to Entra-based authentication using DefaultIdentityTokenCredential. | ||
| // If no SAS is specified, then the default azure credential will be used. |
Comment on lines
47
to
51
| _httpClient = new HttpClient(new HttpClientHandler {CheckCertificateRevocationList = true}) | ||
| { | ||
| Timeout = GeneralUtils.NugetFeedPublisherHttpClientTimeout, | ||
| }; | ||
|
|
||
| if (!string.IsNullOrEmpty(_accessToken)) | ||
| { | ||
| // AAD access tokens are JWTs (three dot-separated segments) and must be sent as Bearer. | ||
| // Personal access tokens (PATs) are opaque strings and use Basic auth. | ||
| bool tokenIsJwt = _accessToken.Split('.').Length == 3; | ||
| _httpClient.DefaultRequestHeaders.Authorization = tokenIsJwt | ||
| ? new AuthenticationHeaderValue("Bearer", _accessToken) | ||
| : new AuthenticationHeaderValue( | ||
| "Basic", | ||
| Convert.ToBase64String(Encoding.ASCII.GetBytes($":{_accessToken}"))); | ||
| } | ||
| else | ||
| { | ||
| // No token provided; acquire an Entra token via DefaultIdentityTokenCredential. | ||
| try | ||
| { | ||
| var credential = new DefaultIdentityTokenCredential( | ||
| new DefaultIdentityTokenCredentialOptions | ||
| { | ||
| ManagedIdentityClientId = task.ManagedIdentityClientId | ||
| }); | ||
| var tokenRequestContext = new TokenRequestContext(new[] { "499b84ac-1321-427f-aa17-267ca6975798/.default" }); | ||
| var token = credential.GetToken(tokenRequestContext, CancellationToken.None); | ||
| _httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token.Token); | ||
| } | ||
| catch (Exception e) | ||
| DefaultRequestHeaders = | ||
| { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…7113)"
This reverts commit 7fbf42f.
To double check: