ci: use microsoft-graph-devx-bot GitHub App instead of PAT#802
Conversation
PoliCheck Scan ReportThe following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.
More information about PoliCheckInformation: PoliCheck | Severity Guidance | Term |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
PoliCheck Scan ReportThe following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.
More information about PoliCheckInformation: PoliCheck | Severity Guidance | Term |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Learn Build status updates of commit 1a834de: 💡 Validation status: suggestions
This comment lists only the first 25 files in the pull request. microsoftgraph/graph-powershell-beta/Microsoft.Graph.Beta.BusinessScenario/Clear-MgBetaSolutionBusinessScenarioPlannerTaskMessageReaction.md
microsoftgraph/graph-powershell-beta/Microsoft.Graph.Beta.BusinessScenario/Microsoft.Graph.Beta.BusinessScenario.md
microsoftgraph/graph-powershell-beta/Microsoft.Graph.Beta.BusinessScenario/New-MgBetaSolutionBusinessScenarioPlannerTaskMessage.md
microsoftgraph/graph-powershell-beta/Microsoft.Graph.Beta.BusinessScenario/Set-MgBetaSolutionBusinessScenarioPlannerTaskMessageReaction.md
microsoftgraph/graph-powershell-beta/Microsoft.Graph.Beta.BusinessScenario/Update-MgBetaSolutionBusinessScenarioPlannerTaskMessage.md
For more details, please refer to the build report. Note: Your PR may contain errors or warnings or suggestions unrelated to the files you changed. This happens when external dependencies like GitHub alias, Microsoft alias, cross repo links are updated. Please use these instructions to resolve them. |
Pivots the weekly reference docs pipeline off the PAT-backed GITHUB_TOKEN secret and onto the existing microsoft-graph-devx-bot GitHub App identity for both the branch push and PR creation. - scripts/Generate-Github-Token.ps1 (new): mints a short-lived App installation token from the App ID + private key. - powershell-docs.yml: fetch App secrets from Key Vault and push using an App installation token (masked) instead of the PAT. - create-pr.yml: mint an App token for gh pr create; drop the redundant PAT-based git push. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1a834de to
247ca93
Compare
PoliCheck Scan ReportThe following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans. ✅ No issues foundMore information about PoliCheckInformation: PoliCheck | Severity Guidance | Term |
|
Learn Build status updates of commit 247ca93: ✅ Validation status: passed
For more details, please refer to the build report. |
The push URL in the weekly docs pipeline had been corrupted to a literal '******github.com/...' (a masked log value pasted into source) since #802, so 'git push' failed silently while the step still reported success because 'git status' ran last. The branch never reached GitHub, so 'gh pr create' failed with 'No commits between main and <branch>'. - generate-docs-steps.yml: fix push URL to https://x-access-token:$token@github.com/..., throw on non-zero 'git push' exit code, and detect real changes by comparing the branch tip to the recorded base commit (the generation scripts pre-commit their output, so the working tree is clean at push time). - create-pr.yml: add a Condition parameter so PR creation is skipped cleanly when there are no changes instead of erroring. - GenerateMarkDown.ps1: track generated file count and fail if generation produces zero files, so a silent generation failure surfaces immediately. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: f3873c6c-209b-4bd2-b1a7-e96a27d4834a
Summary
Migrates the weekly reference docs pipeline off the PAT-backed
GITHUB_TOKENsecret and onto the existing microsoft-graph-devx-bot GitHub App identity, for both the branch push and PR creation. Follows the same pattern as microsoftgraph/MSGraph-SDK-Code-Generator#1442.Changes
scripts/Generate-Github-Token.ps1(new): signs a JWT from the App ID + private key, resolves the installation, and mints a short-lived installation token (copied from the reference repo).azure-pipelines/powershell-docs.yml: adds anAzureKeyVault@2task to fetchmicrosoft-graph-devx-bot-appid/microsoft-graph-devx-bot-privatekeyfromakv-prod-eastus; the push step now mints an App installation token (masked via##vso[task.setsecret]) and pushes withx-access-tokeninstead of the PAT.azure-pipelines/common-templates/create-pr.yml: mints an App token forgh pr create; drops the redundant PAT-basedgit push.Prerequisites
contents:writeandpull_requests:writeon this repo (already granted).Federated AKV Managed Identity Connectionservice connection.GITHUB_TOKENPAT variable can be removed.