[release/10.0] Remove OneLoc PAT dependencies

[missymessa]

Summary

• backport complete removal of the OneLocBuildVariables variable group to release/10.0
• remove the Ceapex and GitHub PAT parameters and all fallback paths
• require short-lived Ceapex WIF and GitHub App tokens in the provisioned projects
• update the OneLoc authentication documentation

Backport of the main cleanup for AB#10151 and AB#12331.

[Copilot]

🟢 Approval recommended

Pull request overview

This PR backports an update to the OneLocBuild job template on release/10.0 to avoid hydrating the legacy OneLoc variable group (and its PAT secrets) when neither the Ceapex PAT nor GitHub PAT fallback can be used.

Changes:

• Conditionally attaches the OneLocBuildVariables variable group only when Ceapex PAT or GitHub PAT fallback authentication may be selected.
• Skips legacy PAT hydration when the job is configured to use both the Ceapex service-connection (Entra/WIF) flow and GitHub App authentication.

File summaries

File	Description
eng/common/core-templates/job/onelocbuild.yml	Adds a compile-time conditional to only include the legacy variable group when one of the PAT fallback paths is possible.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Lite

[mmitche]

The condition looks far too complex. See the PR to main. Wait on changes here until main is resolved.

[Copilot]

🟢 Approval recommended

The change is narrowly scoped to conditional variable-group inclusion and aligns with the existing fallback-selection logic already used later in the same template.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The template should fail fast with a clear validation error when RepoType: gitHub but GitHubAppServiceConnection is empty, and the main OneLocBuild docs should explicitly note the newly enforced project support limitation.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The template currently mints/passes GitHub App credentials based only on RepoType, which can force GitHub App installation/token dependencies even when CreatePr: false, potentially breaking documented onboarding flows and adding avoidable failure modes.

Review details

Suppressed comments (3)

Previously missed (1) — in code that hasn't changed since the last review.

eng/common/core-templates/job/onelocbuild.yml:94

• The GitHub App token is minted whenever RepoType is gitHub, even when CreatePr is false. This adds a Key Vault/service-connection dependency (and potential failure) to runs that may not need to open a PR; consider gating token minting on CreatePr as well.

This issue also appears on line 124 of the same file.

eng/common/core-templates/job/onelocbuild.yml:75

• The template now requires GitHub App auth for GitHub repos, but it does not validate that GitHubAppServiceConnection is non-empty. If a caller overrides it to '', the failure will likely occur later (Key Vault/service connection) with a less actionable error message; consider failing fast like CeapexServiceConnection.

    - ${{ if notIn(variables['System.TeamProject'], 'internal', 'DevDiv') }}:
      - 'OneLocBuild is supported only in dnceng/internal and DevDiv/DevDiv.': error
    - ${{ if eq(parameters.CeapexServiceConnection, '') }}:
      - 'CeapexServiceConnection must identify a WIF service connection.': error

eng/common/core-templates/job/onelocbuild.yml:126

• gitHubPatVariable is supplied for GitHub repos even when CreatePr is false, which can force GitHub authentication work (and potential failures) even though no PR is requested. Consider only supplying gitHubPatVariable when CreatePr is true (while still setting repoType).

        ${{ if eq(parameters.RepoType, 'gitHub') }}:
          repoType: ${{ parameters.RepoType }}
          gitHubPatVariable: "$(GitHubAppInstallationToken)"

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The new project-scope guard uses a notIn(...) expression that may not be supported by Azure Pipelines template expressions and could break template compilation.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite