Skip to content

Use Entra credential for symbol upload, removing dnceng-symbol-server-pat #16688

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
missymessa wants to merge 7 commits into
base: main
Choose a base branch
from
+77 −7
Open

Use Entra credential for symbol upload, removing dnceng-symbol-server-pat #16688

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
5bc41b2
Use Entra credential for symbol upload, removing dnceng-symbol-server…
missymessa Apr 7, 2026
c0543fd
Merge branch 'main' into missymessa-10150
missymessa Apr 10, 2026
2413c8f
Merge branch 'main' into missymessa-10150
missymessa Apr 10, 2026
16b33ca
Add DefaultIdentityTokenCredential fallback for symbol publishing and…
missymessa Apr 10, 2026
ca97ef7
Merge branch 'main' into missymessa-10150
missymessa Apr 13, 2026
e5e60a1
Merge branch 'main' into missymessa-10150
missymessa Apr 20, 2026
28ffc1e
Merge branch 'main' into missymessa-10150
missymessa Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion eng/common/core-templates/steps/publish-logs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@ steps:
'$(akams-client-id)'
'$(microsoft-symbol-server-pat)'
'$(symweb-symbol-server-pat)'
'$(dnceng-symbol-server-pat)'
'$(dn-bot-all-orgs-build-rw-code-rw)'
'$(System.AccessToken)'
${{parameters.CustomSensitiveDataList}}
Expand Down
2 changes: 0 additions & 2 deletions eng/publishing/v3/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@ stages:
displayName: Publish Assets and Symbols
timeoutInMinutes: 120
variables:
- group: DotNet-Symbol-Server-Pats
- group: AzureDevOps-Artifact-Feeds-Pats
- group: Publish-Build-Assets

Expand Down Expand Up @@ -157,7 +156,6 @@ stages:
/p:PDBArtifactsBasePath='$(Build.ArtifactStagingDirectory)/PDBArtifacts/'
/p:SymbolPublishingExclusionsFile='$(Build.ArtifactStagingDirectory)/ReleaseConfigs/SymbolPublishingExclusionsFile.txt'
/p:TempSymbolsAzureDevOpsOrg='dnceng'
/p:TempSymbolsAzureDevOpsOrgToken='$(dnceng-symbol-server-pat)'
/p:SymbolRequestProject='dotnet'
${{ parameters.symbolPublishingAdditionalParameters}}
/p:BuildQuality='${{ parameters.buildQuality }}'
Expand Down
11 changes: 10 additions & 1 deletion src/Microsoft.DotNet.Build.Tasks.Feed/src/PublishArtifactsInManifestBase.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
using Microsoft.Arcade.Common;
using Microsoft.Build.Framework;
using Microsoft.DotNet.Build.Tasks.Feed.Model;
using Azure.Core;
using Azure.Identity;
using Microsoft.DotNet.ProductConstructionService.Client;
using Microsoft.DotNet.ProductConstructionService.Client.Models;
Expand Down Expand Up @@ -718,7 +719,15 @@ public async Task HandleSymbolPublishingAsync(
Task<SymbolUploadHelper> CreatePublishSymbolHelper(string symbolPublishingExclusionsFile, bool publishSpecialClrFiles, bool dryRun)
{
FrozenSet<string> exclusions = LoadExclusions(symbolPublishingExclusionsFile);
PATCredential creds = new(TempSymbolsAzureDevOpsOrgToken);

TokenCredential creds = string.IsNullOrEmpty(TempSymbolsAzureDevOpsOrgToken)
Copy link
Copy Markdown
Member

@mmitche mmitche Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not positive this will work. You'll need to ensure that this identity works in the devdiv version of the pipeline.

Copy link
Copy Markdown
Member Author

@missymessa missymessa Apr 10, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified this against the DevDiv-side setup:

  • eng/publishing/v3/publish.yml runs the publish step under AzureCLI@2 with azureSubscription: maestro-build-promotion.
  • There is a matching maestro-build-promotion azurerm service connection in both dnceng/internal and devdiv/DevDiv.
  • Both point at the same backing app ID: 6e870007-e236-4eb1-8734-8bf8cd54c748 (maestro-build-promotion-mi), and the DevDiv one is isReady=true.

So the DevDiv variant should pick up the same federated identity path as the dnceng pipeline. I also kept the code-side fallback to PATCredential when TempSymbolsAzureDevOpsOrgToken is explicitly provided, so there is still a rollout escape hatch if needed.

Copy link
Copy Markdown
Member Author

@missymessa missymessa Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think Copilot's comment is lying, I need to do some validation here.

? new DefaultIdentityTokenCredential(
new DefaultIdentityTokenCredentialOptions
{
ManagedIdentityClientId = ManagedIdentityClientId
})
: new PATCredential(TempSymbolsAzureDevOpsOrgToken);

TaskTracer tracer = new(Log, verbose: true);

SymbolPublisherOptions options = new(
Expand Down