ci: use microsoft-graph-devx-bot GitHub App instead of PAT

azure-pipelines/common-templates/create-pr.yml

@@ -19,7 +19,8 @@ steps:
   - task: PowerShell@2
     displayName: Create Pull Request for generated build
     env:
-      GITHUB_TOKEN: $(GITHUB_TOKEN)
+      GhAppId: $(microsoft-graph-devx-bot-appid)
+      GhAppKey: $(microsoft-graph-devx-bot-privatekey)
     inputs:
       pwsh: true
       targetType: inline
@@ -28,6 +29,10 @@ steps:
         $Head = "MicrosoftDocs:${{ parameters.TargetBranch }}"
         $Title = "${{ parameters.Title }}"
         $Body = "${{ parameters.Body }}"
+        # The microsoft-graph-devx-bot GitHub App must have pull_requests:write on this repo.
+        $env:GITHUB_TOKEN = & "$(Build.SourcesDirectory)/scripts/Generate-Github-Token.ps1" -AppClientId $env:GhAppId -AppPrivateKeyContents $env:GhAppKey -Repository "MicrosoftDocs/microsoftgraph-docs-powershell"
+        if ([string]::IsNullOrWhiteSpace($env:GITHUB_TOKEN)) { throw "Failed to generate GitHub App installation token." }
+        # Mask the token so it is never surfaced in pipeline logs.
+        Write-Host "##vso[task.setsecret]$env:GITHUB_TOKEN"
         git status
-        git push "https://$(GITHUB_TOKEN)@github.com/MicrosoftDocs/microsoftgraph-docs-powershell.git"
         gh pr create -t $Title -b $Body -B $BaseBranchName -H $Head

azure-pipelines/powershell-docs.yml

@@ -166,21 +166,33 @@ extends:
             pwsh: true
             filePath: scripts/StabilizeMsDate.ps1
             errorActionPreference: 'stop'
+        - task: AzureKeyVault@2
+          displayName: "Azure Key Vault: Get GitHub App secrets"
+          inputs:
+            azureSubscription: "Federated AKV Managed Identity Connection"
+            KeyVaultName: akv-prod-eastus
+            SecretsFilter: "microsoft-graph-devx-bot-appid,microsoft-graph-devx-bot-privatekey"
         - task: PowerShell@2
           displayName: Pushing to github
           env:
-            GITHUB_TOKEN: $(GITHUB_TOKEN)
+            GhAppId: $(microsoft-graph-devx-bot-appid)
+            GhAppKey: $(microsoft-graph-devx-bot-privatekey)
           inputs:
             targetType: inline
             pwsh: true
             script: |
               git config --global user.email "GraphTooling@service.microsoft.com"
               git config --global user.name "Microsoft Graph DevX Tooling"
               git config --system core.longpaths true
+              # The microsoft-graph-devx-bot GitHub App must have contents:write on this repo.
+              $token = & "$(Build.SourcesDirectory)/scripts/Generate-Github-Token.ps1" -AppClientId $env:GhAppId -AppPrivateKeyContents $env:GhAppKey -Repository "MicrosoftDocs/microsoftgraph-docs-powershell"
+              if ([string]::IsNullOrWhiteSpace($token)) { throw "Failed to generate GitHub App installation token." }
+              # Mask the token so it is never surfaced in pipeline logs.
+              Write-Host "##vso[task.setsecret]$token"
               git status
               git add .
               git commit -m "Updating reference docs"
-              git push --set-upstream "https://$(GITHUB_TOKEN)@github.com/MicrosoftDocs/microsoftgraph-docs-powershell.git" $(ComputeBranch.WeeklyReferenceDocsBranch)
+              git push --set-upstream "https://x-access-token:$token@github.com/MicrosoftDocs/microsoftgraph-docs-powershell.git" $(ComputeBranch.WeeklyReferenceDocsBranch)
               git status
         - template: azure-pipelines/common-templates/create-pr.yml@self
           parameters:

scripts/Generate-Github-Token.ps1

@@ -0,0 +1,201 @@
+[CmdletBinding()]
+param (
+    [Parameter(Mandatory = $true)]
+    [string]
+    $AppClientId,
+    [Parameter(Mandatory = $true)]
+    [string]
+    $AppPrivateKeyContents,
+    [Parameter(Mandatory = $true)]
+    [ValidatePattern('^[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+$', ErrorMessage = "Repository must be in the format 'owner/repo' (e.g. 'octocat/hello-world')")]
+    [string]
+    $Repository
+)
+
+$ErrorActionPreference = "Stop"
+
+function Generate-AppToken {
+    param (
+        [string]
+        $ClientId,
+        [string]
+        $PrivateKeyContents
+    )
+
+    $header = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes((ConvertTo-Json -InputObject @{
+                    alg = "RS256"
+                    typ = "JWT"
+                }))).TrimEnd('=').Replace('+', '-').Replace('/', '_');
+
+    $payload = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes((ConvertTo-Json -InputObject @{
+                    iat = [System.DateTimeOffset]::UtcNow.AddSeconds(-10).ToUnixTimeSeconds()
+                    exp = [System.DateTimeOffset]::UtcNow.AddMinutes(1).ToUnixTimeSeconds()
+                    iss = $ClientId 
+                }))).TrimEnd('=').Replace('+', '-').Replace('/', '_');
+
+    $rsa = [System.Security.Cryptography.RSA]::Create()
+    $rsa.ImportFromPem($PrivateKeyContents)
+
+    $signature = [Convert]::ToBase64String($rsa.SignData([System.Text.Encoding]::UTF8.GetBytes("$header.$payload"), [System.Security.Cryptography.HashAlgorithmName]::SHA256, [System.Security.Cryptography.RSASignaturePadding]::Pkcs1)).TrimEnd('=').Replace('+', '-').Replace('/', '_')
+    $jwt = "$header.$payload.$signature"
+
+    return $jwt
+}
+
+function Generate-InstallationToken {
+    param (
+        [string]
+        $AppToken,
+        [string]
+        $InstallationId,
+        [string]
+        $Repository
+    )
+
+    $uri = "https://api.github.com/app/installations/$InstallationId/access_tokens"
+    $headers = @{
+        Authorization          = "Bearer $AppToken"
+        Accept                 = "application/vnd.github+json"
+        "X-GitHub-Api-Version" = "2022-11-28"
+    }
+
+    $body = @{
+        repositories = @($Repository)
+    }
+
+    $response = Invoke-RestMethod -Uri $uri -Method Post -Headers $headers -Body (ConvertTo-Json -InputObject $body -Compress -Depth 10)
+
+    return $response.token
+}
+
+
+function Get-OrganizationInstallationId {
+    param (
+        [string]
+        $AppToken,
+        [string]
+        $Organization
+    )
+
+    $uri = "https://api.github.com/orgs/$Organization/installation"
+    $headers = @{
+        Authorization          = "Bearer $AppToken"
+        Accept                 = "application/vnd.github+json"
+        "X-GitHub-Api-Version" = "2022-11-28"
+    }
+
+    try {
+        $response = Invoke-RestMethod -Uri $uri -Method Get -Headers $headers
+
+        return $response.id
+    }
+    catch [Microsoft.PowerShell.Commands.HttpResponseException] {
+        if ($_.Exception.Response.StatusCode -eq [System.Net.HttpStatusCode]::UnprocessableContent -or $_.Exception.Response.StatusCode -eq [System.Net.HttpStatusCode]::NotFound) {
+            return $null
+        }
+
+        throw
+    }
+}
+
+function Get-RepositoryInstallationId {
+    param (
+        [string]
+        $AppToken,
+        [string]
+        $Repository
+    )
+
+    $uri = "https://api.github.com/repos/$Repository/installation"
+    $headers = @{
+        Authorization          = "Bearer $AppToken"
+        Accept                 = "application/vnd.github+json"
+        "X-GitHub-Api-Version" = "2022-11-28"
+    }
+
+    try {
+        $response = Invoke-RestMethod -Uri $uri -Method Get -Headers $headers
+
+        return $response.id
+    }
+    catch [Microsoft.PowerShell.Commands.HttpResponseException] {
+        if ($_.Exception.Response.StatusCode -eq [System.Net.HttpStatusCode]::UnprocessableContent -or $_.Exception.Response.StatusCode -eq [System.Net.HttpStatusCode]::NotFound) {
+            return $null
+        }
+
+        throw
+    }
+}
+
+function Get-UserInstallationId {
+    param (
+        [string]
+        $AppToken,
+        [string]
+        $Username
+    )
+
+    $uri = "https://api.github.com/users/$Username/installation"
+    $headers = @{
+        Authorization          = "Bearer $AppToken"
+        Accept                 = "application/vnd.github+json"
+        "X-GitHub-Api-Version" = "2022-11-28"
+    }
+
+    try {
+        $response = Invoke-RestMethod -Uri $uri -Method Get -Headers $headers
+
+        return $response.id
+    }
+    catch [Microsoft.PowerShell.Commands.HttpResponseException] {
+        if ($_.Exception.Response.StatusCode -eq [System.Net.HttpStatusCode]::UnprocessableContent -or $_.Exception.Response.StatusCode -eq [System.Net.HttpStatusCode]::NotFound) {
+            return $null
+        }
+
+        throw
+    }
+}
+
+function Get-InstallationId {
+    param (
+        [string]
+        $AppToken,
+        [string]
+        $Owner,
+        [string]
+        $Repo
+    )
+
+    $orgInstallationId = Get-OrganizationInstallationId -AppToken $AppToken -Organization $Owner
+
+    if ($null -eq $orgInstallationId) {
+        $repoInstallationId = Get-RepositoryInstallationId -AppToken $AppToken -Repository "$Owner/$Repo"
+    }
+    else {
+        return $orgInstallationId
+    }
+
+    if ($null -eq $repoInstallationId) {
+        $userInstallationId = Get-UserInstallationId -AppToken $AppToken -Username $Owner
+    }
+    else {
+        return $repoInstallationId
+    }
+
+    if ($null -eq $userInstallationId) {
+        throw "Installation not found for repository '$Repo'"
+    }
+    else {
+        return $userInstallationId
+    }
+}
+
+$owner, $repo = $Repository -split '/'
+
+$AppToken = Generate-AppToken -ClientId $AppClientId -PrivateKeyContents $AppPrivateKeyContents
+
+$InstallationId = Get-InstallationId -AppToken $AppToken -Owner $owner -Repo $repo
+
+$InstallationToken = Generate-InstallationToken -AppToken $AppToken -InstallationId $InstallationId -Repository $repo
+
+Write-Output $InstallationToken