Skip to content

Replace external PublishSymbols task with SymbolUploadHelper-based task (WI 10148/10149)#16691

Open
missymessa wants to merge 2 commits intomainfrom
missymessa-10148-10149
Open

Replace external PublishSymbols task with SymbolUploadHelper-based task (WI 10148/10149)#16691
missymessa wants to merge 2 commits intomainfrom
missymessa-10148-10149

Conversation

@missymessa
Copy link
Copy Markdown
Member

Summary

Replaces the external \Microsoft.SymbolUploader.Build.Task\ dependency in \PublishToSymbolServers.proj\ with a new \PublishSymbolsUsingSymbolUploadHelper\ MSBuild task that uses the proven internal \SymbolUploadHelper\ infrastructure already used by Maestro promotion publishing.

Motivation

WI 10148 (\microsoft-symbol-server-pat) and WI 10149 (\symweb-symbol-server-pat) track the migration of PATs used for symbol publishing to Entra/managed identity auth. The current \PublishToSymbolServers.proj\ uses an external task that only accepts a \PersonalAccessToken\ string parameter, with no support for \TokenCredential-based auth.

The internal \SymbolUploadHelper\ (used by Maestro/Darc promotion) already supports \TokenCredential, making it the natural choice for the migration.

Changes

  1. *New task \PublishSymbolsUsingSymbolUploadHelper* in \Microsoft.DotNet.Build.Tasks.Feed:

    • Wraps \SymbolUploadHelper\ + \SymbolUploadHelperFactory\
    • Auth: if \PersonalAccessToken\ is non-empty → \PATCredential; if empty → \DefaultIdentityTokenCredential\ (Entra/MI/WIF)
    • Accepts \AzdoOrg, \ManagedIdentityClientId, and all existing symbol publishing params
  2. **Updated \PublishToSymbolServers.proj**:

    • Replaced \Microsoft.SymbolUploader.Build.Task\ package reference with \Microsoft.DotNet.Build.Tasks.Feed\
    • \SymbolServerTargets\ now use org names (\microsoft, \microsoftpublicsymbols) instead of full URLs
    • Added \ManagedIdentityClientId\ parameter support

Migration Path

  • Phase 1 (this PR): Deploy the new task. PATs are still passed via \DotNet-Symbol-Server-Pats\ variable group → \PATCredential\ used automatically.
  • Phase 2: Remove PATs from variable group → \DefaultIdentityTokenCredential\ kicks in, using the pipeline's configured identity.

Testing

  • Build succeeded with 0 errors, 0 warnings
  • The existing PR pipeline dry-run test (\�zure-pipelines-pr.yml) continues to work since it passes dummy PATs

Related: AB#10148, AB#10149

…sk (WI 10148/10149)

Replaces the Microsoft.SymbolUploader.Build.Task dependency in PublishToSymbolServers.proj
with a new PublishSymbolsUsingSymbolUploadHelper MSBuild task that uses the proven internal
SymbolUploadHelper infrastructure already used by Maestro promotion publishing.

Key changes:
- New task PublishSymbolsUsingSymbolUploadHelper in Build.Tasks.Feed that wraps SymbolUploadHelper
- Supports both PAT auth (backward compat) and DefaultIdentityTokenCredential (Entra/MI)
- Updated PublishToSymbolServers.proj to use the new task and reference Build.Tasks.Feed
- SymbolServerTargets now use org names (microsoft, microsoftpublicsymbols) instead of URLs

Migration path: When PATs are still configured, PAT auth is used automatically.
When PATs are removed, DefaultIdentityTokenCredential provides Entra auth.
@mmitche mmitche requested a review from hoyosjs April 7, 2026 23:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant