From 61e247cf295b6d08990686d321ea433f169a6ff5 Mon Sep 17 00:00:00 2001 From: Bill Wagner Date: Mon, 10 Aug 2026 13:54:49 -0400 Subject: [PATCH 1/2] Enable secretless authentication Replace the PAT authorization with Entra secretless authentication. I've also added the new secret for the audience parameter and updated the Entra configuration. After this is merged, I'll delete the obsolete quest key. --- .github/workflows/quest-bulk.yml | 11 ++++++++++- .github/workflows/quest.yml | 12 ++++++++++-- 2 files changed, 20 insertions(+), 3 deletions(-) diff --git a/.github/workflows/quest-bulk.yml b/.github/workflows/quest-bulk.yml index 92c78159dc..82dcb6ca53 100644 --- a/.github/workflows/quest-bulk.yml +++ b/.github/workflows/quest-bulk.yml @@ -46,12 +46,21 @@ jobs: tenant-id: ${{ secrets.TENANT_ID }} audience: ${{ secrets.OSMP_API_AUDIENCE }} + + - name: Azure DevOps OpenID Connect + id: azure-devops-oidc-auth + uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main + with: + client-id: ${{ secrets.CLIENT_ID }} + tenant-id: ${{ secrets.TENANT_ID }} + audience: ${{ secrets.QUEST_AUDIENCE }} + - name: bulk-sequester id: bulk-sequester uses: dotnet/docs-tools/actions/sequester@main # main env: ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }} - ImportOptions__ApiKeys__QuestKey: ${{ secrets.QUEST_KEY }} + ImportOptions__ApiKeys__QuestAccessToken: ${{ steps.azure-devops-oidc-auth.outputs.access-token }} ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }} ImportOptions__ApiKeys__SequesterPrivateKey: ${{ secrets.SEQUESTER_PRIVATEKEY }} ImportOptions__ApiKeys__SequesterAppID: ${{ secrets.SEQUESTER_APPID }} diff --git a/.github/workflows/quest.yml b/.github/workflows/quest.yml index c43a0c51d6..5ba912a27b 100644 --- a/.github/workflows/quest.yml +++ b/.github/workflows/quest.yml @@ -50,6 +50,14 @@ jobs: tenant-id: ${{ secrets.TENANT_ID }} audience: ${{ secrets.OSMP_API_AUDIENCE }} + - name: Azure DevOps OpenID Connect for manual test runs + id: azure-devops-oidc-auth + uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main + with: + client-id: ${{ secrets.CLIENT_ID }} + tenant-id: ${{ secrets.TENANT_ID }} + audience: ${{ secrets.QUEST_AUDIENCE }} + # This step occurs when ran manually, passing the manual issue number input - name: manual-sequester if: ${{ github.event_name == 'workflow_dispatch' }} @@ -58,7 +66,7 @@ jobs: env: ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }} ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }} - ImportOptions__ApiKeys__QuestKey: ${{ secrets.QUEST_KEY }} + ImportOptions__ApiKeys__QuestAccessToken: ${{ steps.azure-devops-oidc-auth.outputs.access-token }} ImportOptions__ApiKeys__SequesterPrivateKey: ${{ secrets.SEQUESTER_PRIVATEKEY }} ImportOptions__ApiKeys__SequesterAppID: ${{ secrets.SEQUESTER_APPID }} with: @@ -74,7 +82,7 @@ jobs: env: ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }} ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }} - ImportOptions__ApiKeys__QuestKey: ${{ secrets.QUEST_KEY }} + ImportOptions__ApiKeys__QuestAccessToken: ${{ steps.azure-devops-oidc-auth.outputs.access-token }} ImportOptions__ApiKeys__SequesterPrivateKey: ${{ secrets.SEQUESTER_PRIVATEKEY }} ImportOptions__ApiKeys__SequesterAppID: ${{ secrets.SEQUESTER_APPID }} with: From ad49796f0d06d89ea722041ca39570676c3028a2 Mon Sep 17 00:00:00 2001 From: Bill Wagner Date: Mon, 10 Aug 2026 13:59:32 -0400 Subject: [PATCH 2/2] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/quest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/quest.yml b/.github/workflows/quest.yml index 5ba912a27b..679ff46eef 100644 --- a/.github/workflows/quest.yml +++ b/.github/workflows/quest.yml @@ -50,7 +50,7 @@ jobs: tenant-id: ${{ secrets.TENANT_ID }} audience: ${{ secrets.OSMP_API_AUDIENCE }} - - name: Azure DevOps OpenID Connect for manual test runs + - name: Azure DevOps OpenID Connect id: azure-devops-oidc-auth uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main with: