From 39c646411ccc6dcb6b18987dd6d2f72af2581fd3 Mon Sep 17 00:00:00 2001 From: Missy Messa Date: Wed, 5 Aug 2026 10:09:16 -0700 Subject: [PATCH 1/3] [release/8.0] Remove Publish-Build-Assets references Backport the VG20 cleanup without reintroducing files absent from this release branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8d5c9824-be94-4260-a72c-605d0ce1294d --- eng/common-variables.yml | 2 -- eng/common/templates-official/job/publish-build-assets.yml | 1 - eng/common/templates-official/jobs/codeql-build.yml | 1 - eng/common/templates-official/post-build/common-variables.yml | 2 -- eng/common/templates/job/publish-build-assets.yml | 1 - eng/common/templates/jobs/codeql-build.yml | 1 - eng/common/templates/post-build/common-variables.yml | 2 -- eng/validate-sdk.yml | 1 - 8 files changed, 11 deletions(-) diff --git a/eng/common-variables.yml b/eng/common-variables.yml index 838208ac605..cd367772e31 100644 --- a/eng/common-variables.yml +++ b/eng/common-variables.yml @@ -18,9 +18,7 @@ variables: value: True - name: _SignType value: real - # Publish-Build-Assets provides: BotAccount-dotnet-maestro-bot-PAT # DotNet-HelixApi-Access provides: HelixApiAccessToken - - group: Publish-Build-Assets - group: DotNet-HelixApi-Access - group: SDL_Settings - name: _InternalBuildArgs diff --git a/eng/common/templates-official/job/publish-build-assets.yml b/eng/common/templates-official/job/publish-build-assets.yml index 67a0de433a3..a2fe775ba7e 100644 --- a/eng/common/templates-official/job/publish-build-assets.yml +++ b/eng/common/templates-official/job/publish-build-assets.yml @@ -48,7 +48,6 @@ jobs: variables: - template: /eng/common/templates-official/variables/pool-providers.yml - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: - - group: Publish-Build-Assets - group: AzureDevOps-Artifact-Feeds-Pats - name: runCodesignValidationInjection value: false diff --git a/eng/common/templates-official/jobs/codeql-build.yml b/eng/common/templates-official/jobs/codeql-build.yml index f6476912a86..b62247fe703 100644 --- a/eng/common/templates-official/jobs/codeql-build.yml +++ b/eng/common/templates-official/jobs/codeql-build.yml @@ -17,7 +17,6 @@ jobs: enableTelemetry: true variables: - - group: Publish-Build-Assets # The Guardian version specified in 'eng/common/sdl/packages.config'. This value must be kept in # sync with the packages.config file. - name: DefaultGuardianVersion diff --git a/eng/common/templates-official/post-build/common-variables.yml b/eng/common/templates-official/post-build/common-variables.yml index 173914f2364..c4b8507bb45 100644 --- a/eng/common/templates-official/post-build/common-variables.yml +++ b/eng/common/templates-official/post-build/common-variables.yml @@ -1,6 +1,4 @@ variables: - - group: Publish-Build-Assets - # Whether the build is internal or not - name: IsInternalBuild value: ${{ and(ne(variables['System.TeamProject'], 'public'), contains(variables['Build.SourceBranch'], 'internal')) }} diff --git a/eng/common/templates/job/publish-build-assets.yml b/eng/common/templates/job/publish-build-assets.yml index 9234ccab1a4..b9ca44ada33 100644 --- a/eng/common/templates/job/publish-build-assets.yml +++ b/eng/common/templates/job/publish-build-assets.yml @@ -48,7 +48,6 @@ jobs: variables: - template: /eng/common/templates/variables/pool-providers.yml - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: - - group: Publish-Build-Assets - group: AzureDevOps-Artifact-Feeds-Pats - name: runCodesignValidationInjection value: false diff --git a/eng/common/templates/jobs/codeql-build.yml b/eng/common/templates/jobs/codeql-build.yml index e8b43e3b4cb..a89c1f02682 100644 --- a/eng/common/templates/jobs/codeql-build.yml +++ b/eng/common/templates/jobs/codeql-build.yml @@ -17,7 +17,6 @@ jobs: enableTelemetry: true variables: - - group: Publish-Build-Assets # The Guardian version specified in 'eng/common/sdl/packages.config'. This value must be kept in # sync with the packages.config file. - name: DefaultGuardianVersion diff --git a/eng/common/templates/post-build/common-variables.yml b/eng/common/templates/post-build/common-variables.yml index 173914f2364..c4b8507bb45 100644 --- a/eng/common/templates/post-build/common-variables.yml +++ b/eng/common/templates/post-build/common-variables.yml @@ -1,6 +1,4 @@ variables: - - group: Publish-Build-Assets - # Whether the build is internal or not - name: IsInternalBuild value: ${{ and(ne(variables['System.TeamProject'], 'public'), contains(variables['Build.SourceBranch'], 'internal')) }} diff --git a/eng/validate-sdk.yml b/eng/validate-sdk.yml index b42235807ca..9fab641f6b1 100644 --- a/eng/validate-sdk.yml +++ b/eng/validate-sdk.yml @@ -19,7 +19,6 @@ jobs: name: Logs_ValidateSdk_Windows_NT_Release timeoutInMinutes: 90 variables: - - group: Publish-Build-Assets - _BuildConfig: ${{ parameters.buildConfig }} - _BuildArgs: ${{ parameters.buildArgs }} - _ValidateBlobFeedUrl: ${{ parameters.validateBlobFeedUrl }} From 74c99fe377cc83fedd03e7aa77e94bbee64e42af Mon Sep 17 00:00:00 2001 From: Missy Messa Date: Wed, 5 Aug 2026 11:41:18 -0700 Subject: [PATCH 2/3] [release/8.0] Source validation PAT from scoped group Keep the existing update-packagesource.ps1 authentication functional while avoiding the broad Publish-Build-Assets variable group. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8d5c9824-be94-4260-a72c-605d0ce1294d --- eng/validate-sdk.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/eng/validate-sdk.yml b/eng/validate-sdk.yml index 9fab641f6b1..9f48a9f1dbe 100644 --- a/eng/validate-sdk.yml +++ b/eng/validate-sdk.yml @@ -19,6 +19,7 @@ jobs: name: Logs_ValidateSdk_Windows_NT_Release timeoutInMinutes: 90 variables: + - group: Arcade-Promotion-GitHub - _BuildConfig: ${{ parameters.buildConfig }} - _BuildArgs: ${{ parameters.buildArgs }} - _ValidateBlobFeedUrl: ${{ parameters.validateBlobFeedUrl }} From 47f82575641c75b7e7eb452a50f3638944274310 Mon Sep 17 00:00:00 2001 From: Missy Messa Date: Wed, 5 Aug 2026 17:25:43 -0700 Subject: [PATCH 3/3] Remove retired artifact feed PAT group Remove stale variable-group imports after the group's only secret was retired from Arcade's vault manifest. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8d5c9824-be94-4260-a72c-605d0ce1294d --- eng/common/templates-official/job/publish-build-assets.yml | 1 - eng/common/templates/job/publish-build-assets.yml | 1 - 2 files changed, 2 deletions(-) diff --git a/eng/common/templates-official/job/publish-build-assets.yml b/eng/common/templates-official/job/publish-build-assets.yml index a2fe775ba7e..4842d4c723e 100644 --- a/eng/common/templates-official/job/publish-build-assets.yml +++ b/eng/common/templates-official/job/publish-build-assets.yml @@ -48,7 +48,6 @@ jobs: variables: - template: /eng/common/templates-official/variables/pool-providers.yml - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: - - group: AzureDevOps-Artifact-Feeds-Pats - name: runCodesignValidationInjection value: false - ${{ if eq(parameters.publishAssetsImmediately, 'true') }}: diff --git a/eng/common/templates/job/publish-build-assets.yml b/eng/common/templates/job/publish-build-assets.yml index b9ca44ada33..42c154b1304 100644 --- a/eng/common/templates/job/publish-build-assets.yml +++ b/eng/common/templates/job/publish-build-assets.yml @@ -48,7 +48,6 @@ jobs: variables: - template: /eng/common/templates/variables/pool-providers.yml - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: - - group: AzureDevOps-Artifact-Feeds-Pats - name: runCodesignValidationInjection value: false - ${{ if eq(parameters.publishAssetsImmediately, 'true') }}: