ci: authenticate weekly generation pipelines with GitHub App instead of PAT#3657
Open
ramsessanchez wants to merge 2 commits into
Open
ci: authenticate weekly generation pipelines with GitHub App instead of PAT#3657ramsessanchez wants to merge 2 commits into
ramsessanchez wants to merge 2 commits into
Conversation
…of PAT Mint a short-lived GitHub App installation token from Key Vault (akv-prod-eastus secrets microsoft-graph-devx-bot-appid / -privatekey via the "Federated AKV Managed Identity Connection") and use it for git push and gh pr create, replacing the PAT GITHUB_TOKEN in the weekly-generation, weekly-examples-update, and command-metadata-refresh pipelines. Adds scripts/Generate-Github-Token.ps1 and the reusable common-templates/get-github-app-token.yml, inserted before every push/PR step. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b1e4dbfd-ffcd-4a3e-bd35-1632b2912252
adrian05-ms
previously approved these changes
Jul 10, 2026
This template is not referenced by any pipeline in this repo or in MicrosoftDocs/microsoftgraph-docs-powershell, so it never runs. Removing it as dead code (it also carried the last remaining PAT-based git push). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b1e4dbfd-ffcd-4a3e-bd35-1632b2912252
adrian05-ms
approved these changes
Jul 10, 2026
peombwa
approved these changes
Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Moves the weekly generation pipelines off long-lived PAT authentication and onto a GitHub App installation token, mirroring the approach used by the
MSGraph-SDK-Code-Generatorgeneration pipelines.Instead of
git push/gh pr createusing the PAT$(GITHUB_TOKEN), the pipelines now mint a short-lived (~1h) GitHub App installation token from Key Vault.What changed
New files
scripts/Generate-Github-Token.ps1— builds an RS256-signed JWT from the App client id + private key, resolves the installation id (org → repo → user), and exchanges it for a repository-scoped installation token..azure-pipelines/common-templates/get-github-app-token.yml— fetchesmicrosoft-graph-devx-bot-appid/microsoft-graph-devx-bot-privatekeyfromakv-prod-eastusvia theFederated AKV Managed Identity Connection, runs the script, masks the token, and exposes it to subsequent steps asGITHUB_TOKEN.Wired in before every push / PR (existing
$(GITHUB_TOKEN)references are unchanged and now resolve to the App token):common-templates/create-pr.yml— covers the PR path for all three pipelinescommon-templates/download-openapi-docs.yml— weekly-generation pushgeneration-templates/generate-command-metadata.yml— command-metadata-refresh pushweekly-examples-update.yml— inline examples pushcommand-metadata-refresh.yml— inline version-bump pushThe token is generated immediately before each push to avoid the 1-hour expiry on long-running jobs.
Follow-ups
GITHUB_TOKENPAT can be removed from the ADO library (portal change).generation-templates/generate-helpdocs-template.ymlalso uses the PAT but is not referenced by any active pipeline, so it was left out of scope.Notes
Federated AKV Managed Identity Connectionservice connection is authorized in this ADO project (Key Vault already used by other repos).Note: This pull request was created with assistance from GitHub Copilot.