Use Entra credential for symbol upload, removing dnceng-symbol-server-pat#16688
Open
missymessa wants to merge 4 commits intomainfrom
Open
Use Entra credential for symbol upload, removing dnceng-symbol-server-pat#16688missymessa wants to merge 4 commits intomainfrom
missymessa wants to merge 4 commits intomainfrom
Conversation
…-pat dependency When TempSymbolsAzureDevOpsOrgToken is not provided, use DefaultIdentityTokenCredential (the same credential already used for symbol promotion) instead of PATCredential for symbol uploads. This enables the pipeline to use the AzureCLI@2 task's federated identity (maestro-build-promotion) for symbol management, eliminating the need for the dnceng-symbol-server-pat PAT. - PublishArtifactsInManifestBase.cs: Fall back to DefaultIdentityTokenCredential when TempSymbolsAzureDevOpsOrgToken is empty/null; retain PATCredential for backward compat - publish.yml: Remove DotNet-Symbol-Server-Pats variable group and TempSymbolsAzureDevOpsOrgToken - publish-logs.yml: Remove dnceng-symbol-server-pat from redaction list Fixes: AB#10150
mmitche
reviewed
Apr 7, 2026
| FrozenSet<string> exclusions = LoadExclusions(symbolPublishingExclusionsFile); | ||
| PATCredential creds = new(TempSymbolsAzureDevOpsOrgToken); | ||
|
|
||
| TokenCredential creds = string.IsNullOrEmpty(TempSymbolsAzureDevOpsOrgToken) |
Member
There was a problem hiding this comment.
I'm not positive this will work. You'll need to ensure that this identity works in the devdiv version of the pipeline.
Member
Author
There was a problem hiding this comment.
Verified this against the DevDiv-side setup:
eng/publishing/v3/publish.ymlruns the publish step underAzureCLI@2withazureSubscription: maestro-build-promotion.- There is a matching
maestro-build-promotionazurermservice connection in bothdnceng/internalanddevdiv/DevDiv. - Both point at the same backing app ID:
6e870007-e236-4eb1-8734-8bf8cd54c748(maestro-build-promotion-mi), and the DevDiv one isisReady=true.
So the DevDiv variant should pick up the same federated identity path as the dnceng pipeline. I also kept the code-side fallback to PATCredential when TempSymbolsAzureDevOpsOrgToken is explicitly provided, so there is still a rollout escape hatch if needed.
Member
Author
There was a problem hiding this comment.
I think Copilot's comment is lying, I need to do some validation here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates the symbol upload step in the Arcade publishing pipeline from PAT-based authentication (dnceng-symbol-server-pat) to Entra-based authentication via DefaultIdentityTokenCredential.
Changes
PublishArtifactsInManifestBase.cs
eng/publishing/v3/publish.yml
eng/common/core-templates/steps/publish-logs.yml
Context
The SymbolPublisherOptions class already accepts Azure.Core.TokenCredential -- the PATCredential was just a TokenCredential wrapper around the raw PAT string. The symbol promotion code already uses DefaultIdentityTokenCredential (Entra). This change extends the same pattern to symbol upload.
Prerequisite: The maestro-build-promotion service principal must have symbol management permissions in the dnceng org.
Fixes AB#10150