Switch PAT to GitHubApps#8612
Conversation
🔗 Linked Issue RequiredThanks for the contribution! Please link a GitHub issue to this PR by adding |
There was a problem hiding this comment.
Pull request overview
This PR updates the CLI publish Azure DevOps step template to use a GitHub App–minted token (GH_TOKEN) instead of the azuresdk-github-pat secret, improving consistency and standardizing GitHub authentication across all GitHub CLI interactions during publishing.
Changes:
- Added a shared
login-to-github.ymlstep to mint/exportGH_TOKENfor the current repo owner. - Updated GitHub CLI steps to consume
GH_TOKEN(instead ofazuresdk-github-pat) when checking releases, uploading artifacts, and creating tags.
There was a problem hiding this comment.
Should we also update eng/pipelines/templates/steps/publish-extension.yml, which is used to publish extension releases like https://github.com/Azure/azure-dev/releases/tag/azd-ext-azure-ai-skills_0.1.1-preview?
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
|
Closing this in favor of #8616 |
This pull request updates the
eng/pipelines/templates/steps/publish-cli.ymlpipeline to improve how GitHub authentication is handled during the CLI publishing process. The changes focus on standardizing the use of theGH_TOKENenvironment variable and introducing a login step for GitHub, which helps ensure secure and consistent authentication across steps.Authentication improvements:
login-to-github.yml), withTokenOwnersdynamically set based on the repository name.azuresdk-github-patsecret with theGH_TOKENenvironment variable in all steps that interact with GitHub, including checking for releases, uploading artifacts, and creating tags. [1] [2] [3]@JeffreyCA
Test Pipeline