Skip to content

Remove migrated all-orgs artifact-feed PAT - #17245

Merged
missymessa merged 1 commit into
dotnet:mainfrom
missymessa:missymessa/remove-all-orgs-artifact-feed-pat-manifest
Aug 5, 2026
Merged

Remove migrated all-orgs artifact-feed PAT#17245
missymessa merged 1 commit into
dotnet:mainfrom
missymessa:missymessa/remove-all-orgs-artifact-feed-pat-manifest

Conversation

@missymessa

Copy link
Copy Markdown
Member

Summary

Removes the managed dn-bot-all-orgs-artifact-feeds-rw PAT from the EngKeyVault secret-manager manifest now that all confirmed active consumers have migrated.

Validation

  • Arcade Build Promotion uses keyless Entra publishing on main; real post-merge publishing succeeded in both dnceng and DevDiv.
  • dotnet-interactive NPM publishing migrated to npmAuthenticate@0; post-merge build 3038004 published successfully.
  • release/6.0 direct PAT injection was removed by [release/6.0] Remove artifact-feed PAT from asset publishing #17244; post-merge build 3039325 successfully completed NuGetAuthenticate@1 and Publish Build Assets, pushing BAR build 325726.
  • Maintained Arcade branches have no remaining direct authentication use of this PAT. Remaining release/9.0 and release/10.0 occurrences are log-redaction placeholders only.

After this merges, remove the secret from the Key Vault-backed AzureDevOps-Artifact-Feeds-Pats variable-group sync list, then retire the Key Vault secret.

Related: https://dnceng.visualstudio.com/internal/_workitems/edit/10145

Copilot AI review requested due to automatic review settings August 5, 2026 00:37

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates Arcade’s EngKeyVault secret-manager manifest to remove the managed Azure DevOps PAT dn-bot-all-orgs-artifact-feeds-rw now that known active consumers have migrated away from it.

Changes:

  • Removes the dn-bot-all-orgs-artifact-feeds-rw azure-devops-access-token secret entry from the EngKeyVault manifest.
  • Eliminates the associated #AzureDevOps-Artifact-Feeds-Pats section header in that manifest.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@missymessa
missymessa enabled auto-merge (squash) August 5, 2026 01:52
@missymessa

Copy link
Copy Markdown
Member Author

Validation build 1540241 passed every build and local test leg. The only failure was the Helix monitor timing out after 85 minutes with two jobs still waiting on �windows.11.amd64.client.open�; submission warned that the queue's estimated wait was 45-46 minutes over the 30-minute SLA. This is unrelated to the vault-manifest change. I requeued the PR validation as build 1540415: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1540415

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants