Skip to content

Use GitHub App authentication for promotion validation - #17569

Open
missymessa wants to merge 2 commits into
mainfrom
users/mjanecke/12416-arcade-promotion-github-app
Open

missymessa wants to merge 2 commits into
mainfrom
users/mjanecke/12416-arcade-promotion-github-app

Conversation

@missymessa

@missymessa missymessa commented Sep 16, 2026

Copy link
Copy Markdown
Member

Summary

Replace Arcade promotion validation's Maestro PAT with a short-lived GitHub App installation token.

  • declare arcade-promotion-validation-app as a Secret Manager-managed GitHub App secret
  • mint the token through the existing federated get-github-app-token.yml template
  • pass the token to darc update-dependencies for authenticated common-script retrieval
  • restrict promotion validation to the internal official pipeline so the purpose-specific service connection remains authorized only for pipeline definition 6

Provisioned infrastructure

  • GitHub App: dotnet Arcade Promotion Validation, App ID 4967959
  • Live installation: 162277210, selected-repository mode, exactly dotnet/arcade
  • Effective permissions: contents: read, metadata: read
  • Azure DevOps service connection: dnceng-arcade-promotion-githubapp
  • Managed identity: id-dnceng-arcade-promotion-githubapp
  • Key Vault access: Key Vault Secrets User on only the App ID and private-key secret projections
  • Pipeline authorization: definition 6 only

Completed prerequisites

Required before merge

  • Complete the current PR validation successfully
  • Obtain approval for the current conflict-resolution commit

Post-merge validation and cleanup

  • Run an arcade-official-ci build whose active promotion-validation path reaches Remote.GetCommonScriptFilesAsync
  • Verify installation-token minting, dependency application, temporary branch push/deletion, test-channel promotion, effective repository grants, and an unselected-repository negative control
  • Obtain explicit production-rollout approval before deleting variable group 238 or retiring BotAccount-dotnet-maestro-bot-PAT
  • Record the production evidence on AB#12416 and move the work item to Done

Tracks DNCENG 12416.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 9d4901ab-a32c-4ce3-8cf2-b6f4c1a6e8b5
Copilot AI lite review requested due to automatic review settings September 16, 2026 17:03

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Production authentication and rollout depend on pending infrastructure validation and explicit approval.

Pull request overview

Replaces the promotion validator’s GitHub PAT with a short-lived GitHub App token and limits validation to the internal official pipeline.

Changes:

  • Mints and passes the installation token to darc update-dependencies.
  • Gates promotion validation behind an opt-in parameter.
  • Registers the GitHub App secret projections.
File summaries
File Description
eng/validation/validate-promotion.ps1 Uses the GitHub token for dependency updates.
eng/validate-promotion.yml Mints and supplies the App token.
eng/build.yml Adds opt-in promotion-validation gating.
azure-pipelines.yml Enables validation for official builds.
.vault-config/product-builds-engkeyvault.yaml Registers the GitHub App secret.
Review details
  • Files reviewed: 5/5 changed files
  • Comments generated: 0
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

akoeplinger
akoeplinger previously approved these changes Sep 16, 2026
Resolve the promotion-validation conflicts in favor of the short-lived GitHub App token while preserving the PAT recovery changes now on main.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 9d4901ab-a32c-4ce3-8cf2-b6f4c1a6e8b5

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

It changes production credential/authentication plumbing in official pipelines and requires an official-build canary run to validate the end-to-end darc GitHub access path.

Review details
  • Files reviewed: 5/5 changed files
  • Comments generated: 0 new
  • Review effort level: Lite

@missymessa
missymessa marked this pull request as ready for review September 18, 2026 00:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants