Replace dn-bot-dnceng-build-rw-code-rw PAT with WIF service connection in mirror-within-azdo - #66074
#66074Merged
missymessa merged 3 commits intoApr 2, 2026
maindotnet/aspnetcore:mainfrom
pat-migration/wif-mirror-within-azdodotnet/aspnetcore:pat-migration/wif-mirror-within-azdoCopy head branch name to clipboard
Merged
Replace dn-bot-dnceng-build-rw-code-rw PAT with WIF service connection in mirror-within-azdo#66074missymessa merged 3 commits intomaindotnet/aspnetcore:mainfrom pat-migration/wif-mirror-within-azdodotnet/aspnetcore:pat-migration/wif-mirror-within-azdoCopy head branch name to clipboard
missymessa merged 3 commits into
maindotnet/aspnetcore:mainfrom
pat-migration/wif-mirror-within-azdodotnet/aspnetcore:pat-migration/wif-mirror-within-azdoCopy head branch name to clipboard
Conversation
Migrate the mirror-within-azdo pipeline from using the dn-bot-dnceng-build-rw-code-rw PAT (from the Mirror-Credentials variable group) to the dnceng-build-rw-code-rw-wif Workload Identity Federation service connection. A new AzureCLI@2 step mints an AzDO bearer token via az account get-access-token and stores it as WifAzdoToken. The git clone step now uses this token instead of the PAT. Part of: PAT Migration WI 10139
Member
Author
|
@wtgodbe let me know how I can best test this change! |
Contributor
There was a problem hiding this comment.
Pull request overview
Migrates the azure-pipelines-mirror-within-azdo.yml pipeline from using a long-lived PAT to using a WIF-backed service connection to mint an Azure DevOps access token for intra-AzDO mirroring.
Changes:
- Adds an
AzureCLI@2step that mints an Azure DevOps AAD access token and stores it as a secret pipeline variable (WifAzdoToken). - Updates the
git cloneURL to use the minted token instead of thedn-bot-dnceng-build-rw-code-rwPAT.
wtgodbe
approved these changes
Mar 31, 2026
…used variable group - Extract Azure DevOps resource ID to named variable with comment - Add error handling for token acquisition (exit code + empty check) - Use git -c http.extraheader for clone/push instead of embedding token in the URL (avoids persisting credential in .git/config) - Remove Mirror-Credentials variable group (no longer needed)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrate the \�zure-pipelines-mirror-within-azdo.yml\ pipeline from using the \dn-bot-dnceng-build-rw-code-rw\ PAT (from the \Mirror-Credentials\ variable group) to the \dnceng-build-rw-code-rw-wif\ Workload Identity Federation service connection.
Changes
Why this works
The clone URL uses basic-auth format \https://dn-bot:@dev.azure.com/.... AzDO accepts bearer tokens as the password in basic auth with any username, so this is a drop-in replacement. The subsequent \git push\ inherits the credentials from the clone.
Pipeline
elease/10.0\ branches
Related