Fix service connection references in response to Azure DevOps OIDC changes#2013
Merged
lbussell merged 11 commits intodotnet:mainfrom Mar 12, 2026
Merged
Fix service connection references in response to Azure DevOps OIDC changes#2013lbussell merged 11 commits intodotnet:mainfrom
lbussell merged 11 commits intodotnet:mainfrom
Conversation
Azure DevOps now requires service connections to be explicitly referenced within the stage that requests the OIDC token. Previously, referencing them in the SetupServiceConnectionsStage was sufficient for the entire pipeline. - Create reference-service-connections.yml step template that emits AzureCLI@2 steps for specified registries from publishConfig - Include it in copy-base-images.yml job template (unofficial pipeline) - Include it in check-base-image-updates.yml job template (official pipeline) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Windows agents don't have pwsh (PowerShell Core). Added dockerClientOS parameter to select the correct script type. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Non-registry service connections (kusto, marStatus) need OIDC token references too. Thread the additionalServiceConnections parameter from build-test-publish.yml through to publish.yml job template, and pass it to reference-service-connections.yml. Also update reference-service-connections.yml to accept a direct serviceConnections list alongside the publishConfig-based registries. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- add per-job service connection references to cleanup stages - remove setup-service-connections stage usage from build, check, and mirror stage templates - stop cleanup pipelines from passing serviceConnections into 1ES templates Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The setup-service-connections stage no longer works due to Azure DevOps OIDC scoping changes - service connections must be referenced from the stage that requests the token. All jobs now self-reference their service connections via reference-service-connections.yml. - Delete setup-service-connections.yml - Remove serviceConnections param from 1es-official.yml and 1es-unofficial.yml - Fix annotate-eol-digests.yml to use inline reference step Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Rewrite reference-service-connections.yml header with full usage docs - Add descriptions to additionalServiceConnections across template chain - Create CHANGELOG.md documenting the breaking change Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
mthalman
approved these changes
Mar 12, 2026
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Service connections don't exist in the public project, so the AzureCLI@2 reference steps must be skipped for PR validation and public project builds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
lbussell
added a commit
to lbussell/docker-tools
that referenced
this pull request
Mar 13, 2026
The generate-matrix.yml job template was missed in PR dotnet#2013 when reference-service-connections.yml was added to other job templates. This causes OIDC auth failures when --trim-cached-images checks base image digests in the ACR mirror registry. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
lbussell
added a commit
to lbussell/docker-tools
that referenced
this pull request
Mar 13, 2026
The generate-matrix.yml job template was missed in PR dotnet#2013 when reference-service-connections.yml was added to other job templates. This causes OIDC auth failures when --trim-cached-images checks base image digests in the ACR mirror registry. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
lbussell
added a commit
that referenced
this pull request
Mar 13, 2026
The generate-matrix.yml job template was missed in PR #2013 when reference-service-connections.yml was added to other job templates. This causes OIDC auth failures when --trim-cached-images checks base image digests in the ACR mirror registry. This fixes the build error seen in dotnet-buildtools-prereqs-docker build#2925830. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR fixes #2012.
Azure DevOps changed OIDC token scoping so that service connections must be referenced in the same stage that requests the token. This broke all pipelines because we were referencing them in a separate SetupServiceConnectionsStage. This PR replaces that pattern with reference-service-connections.yml, a step template included in each job that needs OIDC, referencing only the connections that job uses. The setup stage and its plumbing in the 1ES templates have been removed.
Internal unofficial pipeline run demonstrating that the new approach works: build#2924511