[release/11.0] Remove OneLoc PAT dependencies - #17442
Conversation
Acquire a short-lived Ceapex feed token in both supported Azure DevOps projects so DevDiv consumers no longer fall back to dn-bot-ceapex-package-r. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 42b6e46d-b9c0-4558-856d-1d1bdb50609d
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 42b6e46d-b9c0-4558-856d-1d1bdb50609d
There was a problem hiding this comment.
Pull request overview
Backport to release/11.0 of the OneLocBuild authentication behavior that prefers WIF (Entra workload identity federation) for Ceapex feed access in the supported Azure DevOps projects (dnceng/internal and DevDiv/DevDiv), while preserving the existing PAT fallback behavior for other projects and explicit opt-out callers. This aligns Arcade’s OneLocBuild template behavior with the authorized, project-scoped service connections in those environments.
Changes:
- Enable the WIF token acquisition path for Ceapex feeds when
System.TeamProjectisinternalorDevDiv. - Keep PAT-based auth as the default fallback for all other projects and when
CeapexServiceConnection: ''is explicitly set. - Document the
CeapexServiceConnectionparameter behavior and the pipeline authorization requirement.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| eng/common/core-templates/job/onelocbuild.yml | Expands the existing WIF gating logic from internal only to internal + DevDiv, while keeping PAT fallback for other projects/opt-out. |
| Documentation/OneLocBuild.md | Documents the CeapexServiceConnection parameter, supported projects, and the need to authorize pipelines for the service connection. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Import the legacy variable group only when the Ceapex or GitHub PAT fallback can be selected. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bc4e1c74-f3b4-4965-932e-5e63cff7e877
missymessa
changed the title
There was a problem hiding this comment.
🟢 Approval recommended
Review details
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
Documentation/OneLocBuild.md:203
- This new parameter row references
CeapexPat, butCeapexPatisn’t described anywhere else in this doc. That leaves a dangling reference for readers and makes the table harder to understand.
| `CeapexServiceConnection` | `'dnceng-onelocbuild-ceapex'` | The project-scoped WIF service connection used to acquire a short-lived token for the Ceapex feeds. This path is enabled in `dnceng/internal` and `DevDiv/DevDiv`; other projects continue to use `CeapexPat`. Pipelines in either supported project must be authorized to use their project's connection. Set to `''` to explicitly use the PAT path. |
- Files reviewed: 2/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c08e3391-52d8-42e3-ad8c-ef2e5be92291
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a6ad3a92-2023-4c67-8948-f6d34de1a67c
There was a problem hiding this comment.
🟢 Approval recommended
The conditional variable-group import and DevDiv WIF enablement are consistent with the stated fallback behavior and the updated documentation.
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🔵 Needs a closer look
It changes authentication/secret-selection behavior in a shared pipeline template where incorrect conditions could break localization flows across multiple projects.
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
mmitche
left a comment
mmitche
left a comment
There was a problem hiding this comment.
Wait on resolution and check-in of main before this backport
There was a problem hiding this comment.
🟢 Approval recommended
The updated conditions for WIF/PAT selection and variable-group import are internally consistent with the template’s existing boolean/string comparison patterns and align with the documented fallback behavior.
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
missymessa
changed the title
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
There are documentation inconsistencies (stale GitHub App auth doc) and a repo-inconsistent notIn expression usage that should be corrected before merging.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 2
- Review effort level: Lite
There was a problem hiding this comment.
🟡 Changes recommended
Documentation and validation need to be aligned with the removal of PAT fallbacks (notably the stale GitHub App doc reference and missing up-front GitHub App parameter validation).
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (1)
Documentation/OneLocBuild.md:204
OneLocBuild.mdnow documents the removal of PAT-based options, but the linked/relatedOneLocBuildGitHubApp.mdstill describesUseGitHubAppAuthentication*parameters and aGithubPatfallback path that no longer exist inonelocbuild.yml. This will confuse consumers following the GitHub App setup doc; please update that doc (or remove/redirect the link) as part of this change.
| `CeapexServiceConnection` | `'dnceng-onelocbuild-ceapex'` | The project-scoped WIF service connection used to acquire a short-lived token for the Ceapex feeds. OneLocBuild supports only `dnceng/internal` and `DevDiv/DevDiv`; pipelines must be authorized to use the connection. |
| `GitHubAppServiceConnection` | `'dnceng-oneloc-githubapp'` | The dnceng/internal WIF service connection used to sign the App JWT. When the value remains the default, Arcade automatically uses `devdiv-oneloc-githubapp` in `DevDiv/DevDiv`. |
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🔵 Needs a closer look
It changes authentication and execution gating in a shared pipeline template, so a human should validate the behavior in representative internal/DevDiv pipelines before approval.
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 0 new
- Review effort level: Lite
Summary
release/11.0OneLocBuildVariablesvariable group, Ceapex and GitHub PAT parameters, and all fallback pathsBackports the WIF migration and cleanup tracked by AB#10151 and AB#12331.