Skip to content

Remove legacyCredential PAT usage from Arcade templates#16920

Open
missymessa wants to merge 1 commit into
mainfrom
dev/mjanecke/remove-legacy-artifact-feeds-pat
Open

Remove legacyCredential PAT usage from Arcade templates#16920
missymessa wants to merge 1 commit into
mainfrom
dev/mjanecke/remove-legacy-artifact-feeds-pat

Conversation

@missymessa
Copy link
Copy Markdown
Member

Summary

Removes the legacyCredential parameter from enable-internal-sources.yml calls in publish-build-assets.yml and post-build.yml. This eliminates the dependency on the dn-bot-dnceng-artifact-feeds-rw PAT for DevDiv pipeline feed authentication.

How it works

The enable-internal-sources.yml template already has a built-in path for DevDiv projects that uses the dnceng-artifacts-feeds-read federated service connection (WIF-backed). When legacyCredential is passed, it overrides this modern auth path with PAT-based auth unnecessarily.

By removing the parameter, DevDiv pipelines will now use the WIF service connection automatically.

Validation

  • The dnceng-artifacts-feeds-read SC in DevDiv has been verified working (FIC configured, SC passes verification)
  • 21 DevDiv pipelines have been authorized for the SC
  • Post-merge monitoring required: first CI build after merge should confirm feed auth works

Fixes AB#10143

The enable-internal-sources.yml template already handles DevDiv projects
by using the 'dnceng-artifacts-feeds-read' federated service connection.
Passing legacyCredential overrides this with PAT-based auth unnecessarily.

This removes the PAT dependency (dn-bot-dnceng-artifact-feeds-rw) from
publish-build-assets and post-build templates.

Fixes AB#10143
Copilot AI review requested due to automatic review settings May 29, 2026 18:47
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Removes the legacyCredential PAT parameter from two enable-internal-sources.yml template invocations so DevDiv pipelines fall through to the federated dnceng-artifacts-feeds-read service connection auth path instead of using the dn-bot-dnceng-artifact-feeds-rw PAT.

Changes:

  • Drop legacyCredential: $(dn-bot-dnceng-artifact-feeds-rw) from the enable-internal-sources.yml call in post-build.yml.
  • Drop the DevDiv-conditional legacyCredential parameter block from the enable-internal-sources.yml call in publish-build-assets.yml.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
eng/common/core-templates/post-build/post-build.yml Removes PAT-based legacyCredential parameter so federated WIF auth is used.
eng/common/core-templates/job/publish-build-assets.yml Removes DevDiv-only legacyCredential block so federated WIF auth is used.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants