From 07b71cba4e0c0177e69ea1e0d231ab01fff501ae Mon Sep 17 00:00:00 2001 From: Missy Messa Date: Sun, 23 Aug 2026 10:12:24 -0700 Subject: [PATCH 1/2] Validate OneLoc GitHub App service connection Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0e1a942f-a44f-4e3a-8d35-af3fe8bee535 --- Documentation/OneLocBuildGitHubApp.md | 4 ++-- eng/common/core-templates/job/onelocbuild.yml | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/Documentation/OneLocBuildGitHubApp.md b/Documentation/OneLocBuildGitHubApp.md index 6ae04040d9d..4fe65cf34a4 100644 --- a/Documentation/OneLocBuildGitHubApp.md +++ b/Documentation/OneLocBuildGitHubApp.md @@ -117,8 +117,8 @@ the pipeline must be authorized to use the connection. | **Parameter** | **Default** | **Notes** | |:-:|:-:|-| | `UseGitHubAppAuthentication` | `true` | Activates the App path for GitHub repos in `dnceng/internal` and `DevDiv/DevDiv`, or in another project that explicitly opts in. Set to `false` to select the PAT path. | -| `UseGitHubAppAuthenticationInOtherProjects` | `false` | Explicitly activates the App path outside `dnceng/internal` and `DevDiv/DevDiv`. Requires separately provisioned infrastructure. | -| `GitHubAppServiceConnection` | `'dnceng-oneloc-githubapp'` | The Azure DevOps **WIF service connection** used by `dnceng/internal` and explicit opt-ins. When the value remains the `dnceng-oneloc-githubapp` default, Arcade selects `devdiv-oneloc-githubapp` automatically in `DevDiv/DevDiv`; overrides to a different value are preserved. | +| `UseGitHubAppAuthenticationInOtherProjects` | `false` | Explicitly activates the App path outside `dnceng/internal` and `DevDiv/DevDiv`. Requires separately provisioned infrastructure and an explicit `GitHubAppServiceConnection` override. | +| `GitHubAppServiceConnection` | `'dnceng-oneloc-githubapp'` | The Azure DevOps **WIF service connection** used by `dnceng/internal`. When the value remains the default, Arcade selects `devdiv-oneloc-githubapp` automatically in `DevDiv/DevDiv`. Outside those projects, opting in while retaining the default produces a template error; callers must specify their project-scoped connection. | | `GitHubAppClientId` | `'Iv23lijBU8x3gc9lDOc9'` | The GitHub App's **Client ID** (used as the JWT `iss` claim). | | `GitHubAppKeyVaultName` | `'EngKeyVault'` | The Key Vault holding the App's RSA signing key. | | `GitHubAppKeyName` | `'oneloc-localization-app-key'` | The name of the RSA key inside that Key Vault (the App's private key). | diff --git a/eng/common/core-templates/job/onelocbuild.yml b/eng/common/core-templates/job/onelocbuild.yml index ce077368e40..48b1197934c 100644 --- a/eng/common/core-templates/job/onelocbuild.yml +++ b/eng/common/core-templates/job/onelocbuild.yml @@ -82,6 +82,9 @@ jobs: - ${{ if eq(parameters.is1ESPipeline, '') }}: - 'Illegal entry point, is1ESPipeline is not defined. Repository yaml should not directly reference templates in core-templates folder.': error + - ${{ if and(eq(parameters.UseGitHubAppAuthenticationInOtherProjects, true), ne(variables['System.TeamProject'], 'internal'), ne(variables['System.TeamProject'], 'DevDiv'), eq(parameters.GitHubAppServiceConnection, 'dnceng-oneloc-githubapp')) }}: + - 'GitHubAppServiceConnection must be overridden when UseGitHubAppAuthenticationInOtherProjects is enabled outside dnceng/internal and DevDiv/DevDiv.': error + - ${{ if ne(parameters.SkipLocProjectJsonGeneration, 'true') }}: - task: Powershell@2 inputs: From ba556cb7b1d66ba1760ac6aecfbae4640b9bf9ff Mon Sep 17 00:00:00 2001 From: Missy Messa Date: Mon, 24 Aug 2026 07:16:55 -0700 Subject: [PATCH 2/2] Limit OneLoc validation to GitHub App auth Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0e1a942f-a44f-4e3a-8d35-af3fe8bee535 --- eng/common/core-templates/job/onelocbuild.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/eng/common/core-templates/job/onelocbuild.yml b/eng/common/core-templates/job/onelocbuild.yml index 48b1197934c..aeff4f43e4d 100644 --- a/eng/common/core-templates/job/onelocbuild.yml +++ b/eng/common/core-templates/job/onelocbuild.yml @@ -82,7 +82,7 @@ jobs: - ${{ if eq(parameters.is1ESPipeline, '') }}: - 'Illegal entry point, is1ESPipeline is not defined. Repository yaml should not directly reference templates in core-templates folder.': error - - ${{ if and(eq(parameters.UseGitHubAppAuthenticationInOtherProjects, true), ne(variables['System.TeamProject'], 'internal'), ne(variables['System.TeamProject'], 'DevDiv'), eq(parameters.GitHubAppServiceConnection, 'dnceng-oneloc-githubapp')) }}: + - ${{ if and(eq(parameters.RepoType, 'gitHub'), eq(parameters.UseGitHubAppAuthentication, true), eq(parameters.UseGitHubAppAuthenticationInOtherProjects, true), ne(variables['System.TeamProject'], 'internal'), ne(variables['System.TeamProject'], 'DevDiv'), eq(parameters.GitHubAppServiceConnection, 'dnceng-oneloc-githubapp')) }}: - 'GitHubAppServiceConnection must be overridden when UseGitHubAppAuthenticationInOtherProjects is enabled outside dnceng/internal and DevDiv/DevDiv.': error - ${{ if ne(parameters.SkipLocProjectJsonGeneration, 'true') }}: