Repository navigation
Narrow publishing credential access - #17247
Conversation
Use a promotion-specific variable group for the Maestro GitHub PAT and remove obsolete log-redaction inputs from the shared publishing group. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8d5c9824-be94-4260-a72c-605d0ce1294d
There was a problem hiding this comment.
Pull request overview
This PR tightens credential scope in Arcade’s internal promotion validation and reduces unnecessary secret inputs to binlog redaction, aligning publishing credentials with least-privilege access for the official pipeline.
Changes:
- Switched promotion validation to use the
Arcade-Promotion-GitHubvariable group for the Maestro GitHub PAT. - Removed expired/stale secret variables from the binlog redaction arguments.
- Removed an obsolete comment describing credentials provided by a shared variable group.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| eng/validate-promotion.yml | Uses the promotion-specific variable group to source the Maestro GitHub PAT for validate-promotion. |
| eng/common/core-templates/steps/publish-logs.yml | Drops stale secret variables from the redact-logs invocation inputs. |
| eng/common-variables.yml | Removes outdated documentation about which credentials the shared variable group provides. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Move the remaining Maestro and AkaMS application IDs to a publishing-specific group authorized only for the centralized build-promotion pipeline, and remove unused Publish-Build-Assets imports. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8d5c9824-be94-4260-a72c-605d0ce1294d
|
Authorization audit update: the two values previously planned to remain in VG20 are consumed by the centralized v3 promotion definition, not by the 148 producer/validation definitions that inherited VG20. This PR now moves them to VG240, authorized only for pipeline 750, and removes all remaining VG20 imports so the broad group can be retired after merge. |
Summary
Authorization audit
Tracking: https://dev.azure.com/dnceng/internal/_workitems/edit/10812