Use GitHub App authentication for promotion validation - #17569
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9d4901ab-a32c-4ce3-8cf2-b6f4c1a6e8b5
There was a problem hiding this comment.
🔵 Needs a closer look
Production authentication and rollout depend on pending infrastructure validation and explicit approval.
Pull request overview
Replaces the promotion validator’s GitHub PAT with a short-lived GitHub App token and limits validation to the internal official pipeline.
Changes:
- Mints and passes the installation token to
darc update-dependencies. - Gates promotion validation behind an opt-in parameter.
- Registers the GitHub App secret projections.
File summaries
| File | Description |
|---|---|
eng/validation/validate-promotion.ps1 |
Uses the GitHub token for dependency updates. |
eng/validate-promotion.yml |
Mints and supplies the App token. |
eng/build.yml |
Adds opt-in promotion-validation gating. |
azure-pipelines.yml |
Enables validation for official builds. |
.vault-config/product-builds-engkeyvault.yaml |
Registers the GitHub App secret. |
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Resolve the promotion-validation conflicts in favor of the short-lived GitHub App token while preserving the PAT recovery changes now on main. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9d4901ab-a32c-4ce3-8cf2-b6f4c1a6e8b5
There was a problem hiding this comment.
🔵 Needs a closer look
It changes production credential/authentication plumbing in official pipelines and requires an official-build canary run to validate the end-to-end darc GitHub access path.
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🔵 Needs a closer look
It changes official-pipeline authentication and execution gating in ways that can only be fully validated via an internal official run exercising the promotion-validation path end-to-end.
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 0 new
- Review effort level: Lite
Summary
Replace Arcade promotion validation's Maestro PAT with a short-lived GitHub App installation token.
arcade-promotion-validation-appas a Secret Manager-managed GitHub App secretget-github-app-token.ymltemplatedarc update-dependenciesfor authenticated common-script retrievalProvisioned infrastructure
4967959162277210, selected-repository mode, exactlydotnet/arcadecontents: read,metadata: readdnceng-arcade-promotion-githubappid-dnceng-arcade-promotion-githubappKey Vault Secrets Useron only the App ID and private-key secret projectionsCompleted prerequisites
dotnet/arcadeand verify effective accessdotnetorganization; the native installation is already completemainafter temporary PAT recovery PR Restore GitHub credential for promotion validation #17568 and resolve the promotion-validation conflicts in favor of the App tokenRequired before merge
Post-merge validation and cleanup
arcade-official-cibuild whose active promotion-validation path reachesRemote.GetCommonScriptFilesAsyncBotAccount-dotnet-maestro-bot-PATDoneTracks DNCENG 12416.