Summary
Every main run of the microsoft-testfx official pipeline has failed since 20260728.11 (2026-07-28 ~16:23 UTC). The only failing leg is the OneLocBuild task; Windows, Linux, SDL and Publish Assets all pass.
Latest occurrence: Run 20260729.6 (build 3034270).
Root cause
The localization build itself succeeds — strings are handed off and LocPayload.json is generated. It fails at the very first GitHub API call of the check-in step (GitHubCheckin.InitializeAsync -> Get a repository):
OneLocBuildClient.exe Error: 0 : Octokit.ForbiddenException: The 'Microsoft Open Source' enterprise
forbids access via a personal access tokens (classic) if the token's lifetime is greater than 8 days.
Please adjust your token's lifetime at the following URL: https://github.com/settings/tokens/5056184827
The credential is $(BotAccount-dotnet-bot-repo-PAT), the default for the GithubPat parameter of eng/common/core-templates/job/onelocbuild.yml. It is a Key Vault backed secret (EngKeyVault) exposed through the dnceng-owned OneLocBuildVariables variable group (dnceng/internal, group id 103). The repo cannot rotate or replace it.
Why only us: dotnet-org repos using the exact same secret are unaffected — dotnet-roslyn-official 20260729.1/.2 and dotnet-sdk-official-ci 20260728.12 all have a green OneLocBuild. testfx targets GitHubOrg: microsoft / MirrorRepo: testfx, and the microsoft org sits in the Microsoft Open Source GitHub enterprise, whose token policy now rejects classic PATs with a lifetime greater than 8 days. microsoft/vstest uses the same GitHubOrg: microsoft configuration and will hit this on its next official run.
Impact
OneLocBuild was a job of the build stage, so its failure failed the stage. The post-build Validate Build Assets and Publish using Darc stages both depend on build, so both were skipped on every run since 2026-07-28 — official asset publishing has been stopped by a job that only opens a translation PR.
Mitigation (done)
Moved the OneLocBuild job into a standalone Localization stage with dependsOn: [], matching the layout dotnet/runtime uses. A loc break still surfaces as a red stage, but it no longer gates validation and publishing.
Remaining work (needs dnceng)
The check-in itself will stay broken until BotAccount-dotnet-bot-repo-PAT is replaced with a credential the Microsoft Open Source enterprise accepts — a classic PAT with a lifetime of 8 days or less, a fine-grained PAT, or a GitHub App token. This needs to be raised with .NET Engineering Services (First Responders / dotnet/arcade), since the secret and the OneLocBuildVariables group are theirs. Until then no localization PRs will land in this repo.
Summary
Every
mainrun of the microsoft-testfx official pipeline has failed since 20260728.11 (2026-07-28 ~16:23 UTC). The only failing leg is theOneLocBuildtask; Windows, Linux, SDL and Publish Assets all pass.Latest occurrence: Run 20260729.6 (build 3034270).
Root cause
The localization build itself succeeds — strings are handed off and
LocPayload.jsonis generated. It fails at the very first GitHub API call of the check-in step (GitHubCheckin.InitializeAsync-> Get a repository):The credential is
$(BotAccount-dotnet-bot-repo-PAT), the default for theGithubPatparameter ofeng/common/core-templates/job/onelocbuild.yml. It is a Key Vault backed secret (EngKeyVault) exposed through the dnceng-ownedOneLocBuildVariablesvariable group (dnceng/internal, group id 103). The repo cannot rotate or replace it.Why only us:
dotnet-org repos using the exact same secret are unaffected —dotnet-roslyn-official20260729.1/.2 anddotnet-sdk-official-ci20260728.12 all have a greenOneLocBuild. testfx targetsGitHubOrg: microsoft/MirrorRepo: testfx, and themicrosoftorg sits in the Microsoft Open Source GitHub enterprise, whose token policy now rejects classic PATs with a lifetime greater than 8 days. microsoft/vstest uses the sameGitHubOrg: microsoftconfiguration and will hit this on its next official run.Impact
OneLocBuildwas a job of thebuildstage, so its failure failed the stage. The post-buildValidate Build AssetsandPublish using Darcstages both depend onbuild, so both were skipped on every run since 2026-07-28 — official asset publishing has been stopped by a job that only opens a translation PR.Mitigation (done)
Moved the OneLocBuild job into a standalone
Localizationstage withdependsOn: [], matching the layout dotnet/runtime uses. A loc break still surfaces as a red stage, but it no longer gates validation and publishing.Remaining work (needs dnceng)
The check-in itself will stay broken until
BotAccount-dotnet-bot-repo-PATis replaced with a credential the Microsoft Open Source enterprise accepts — a classic PAT with a lifetime of 8 days or less, a fine-grained PAT, or a GitHub App token. This needs to be raised with .NET Engineering Services (First Responders / dotnet/arcade), since the secret and theOneLocBuildVariablesgroup are theirs. Until then no localization PRs will land in this repo.