Use build identity for internal feeds instead of expired dn-bot-dnceng-artifact-feeds-rw PAT (release/9.0) - #67853
Merged
wtgodbe merged 1 commit intoJul 16, 2026
Conversation
…expired dn-bot-dnceng-artifact-feeds-rw PAT The dn-bot-dnceng-artifact-feeds-rw PAT was removed from the arcade secret manifest (PR #17079) and expired 2026-07-11, breaking internal feed restore (401 on darc-int-* and dotnet-*-internal feeds) on this servicing branch. Removing legacyCredential lets enable-internal-sources take the internal-project path (SetupNugetSources + NuGetAuthenticate@1), authenticating via the build service identity, which has read on these feeds. Matches main. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 331a413c-8b88-448e-8913-6ca49130a046
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the servicing branch’s official build pipeline to stop using an expired/removed PAT for authenticating to internal Azure Artifacts feeds, and instead rely on the pipeline’s build identity-based authentication path already supported by the shared enable-internal-sources template.
Changes:
- Removed the
legacyCredential: $(dn-bot-dnceng-artifact-feeds-rw)parameter from theenable-internal-sourcesstep so the template falls back to its non-PAT behavior (SetupNugetSources without password +NuGetAuthenticate@1).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
akoeplinger
approved these changes
Jul 16, 2026
wtgodbe
approved these changes
Jul 16, 2026
Member
|
Merging to unblock internal builds |
Open
3 tasks
This was referenced Aug 12, 2026
Open
Merged
This was referenced Aug 24, 2026
Open
Open
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Internal official builds on this servicing branch are failing package restore with HTTP 401 on all
darc-int-*anddotnet-*-internalfeeds (e.g. build 3022753). Root cause: thedn-bot-dnceng-artifact-feeds-rwPAT was removed from the arcade secret manifest (arcade PR #17079, 2026-07-08) and expired 2026-07-11; rotation had stopped, solegacyCredential: $(dn-bot-dnceng-artifact-feeds-rw)now injects an expired/empty token.Change
Remove the
legacyCredentialPAT parameter from theenable-internal-sourcesstep. For theinternalproject the template then takes the build-identity path (SetupNugetSourceswithout a password +NuGetAuthenticate@1), authenticating internal feeds via the pipeline's build service identity. This matches howmainalready works.Validation
contributorondarc-int-*,collaboratorondotnet9-internal,contributorondotnet8-internal.mainbuilds restore internal feeds successfully with no PAT.Tracking: dnceng/internal AB#11679 (live-site AB#11678).