Skip to content

Commit b7f9ce2

Browse files
JimSuplizioJimSuplizio
authored
Changes to scripts to deal with PATs and AccessTokens (#8340)
* Changes to scripts to deal with PATs and AccessTokens * Remove trailing backtick from the last line of the inline script * fix path * the linter pipeline is public, not internal * swap access and auth for add-retention-lease * comment out the task that queues with the PAT * AuthToken to BearerToken and remove unused Base64EncodedAuthToken from the script parameters * remove unneccsary if not null check for the mandatory parameter * Adding sync-directory changes to the PR
1 parent e78dfab commit b7f9ce2

5 files changed

Lines changed: 155 additions & 61 deletions

File tree

‎eng/common/scripts/Add-RetentionLease.ps1‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,29 +18,31 @@ param(
1818
[Parameter(Mandatory = $false)]
1919
[string]$OwnerId = "azure-sdk-pipeline-automation",
2020

21-
[Parameter(Mandatory = $false)]
21+
# This script shouldn't need anything other than the $System.AccessToken from
22+
# from the build pipeline. The retain-run.yml template doesn't run outside
23+
# of the pipeline it's manipulating the retention leases for.
24+
[Parameter(Mandatory = $true)]
2225
[string]$AccessToken = $env:DEVOPS_PAT
2326
)
2427

2528
Set-StrictMode -Version 3
2629

2730
. (Join-Path $PSScriptRoot common.ps1)
2831

29-
$encodedAuthToken = Get-Base64EncodedToken $AccessToken
32+
$Base64EncodedToken = Get-Base64EncodedToken $AccessToken
3033

3134
LogDebug "Checking for existing leases on run: $RunId"
32-
$existingLeases = Get-RetentionLeases -Organization $Organization -Project $Project -DefinitionId $DefinitionId -RunId $RunId -OwnerId $OwnerId -Base64EncodedAuthToken $encodedAuthToken
35+
$existingLeases = Get-RetentionLeases -Organization $Organization -Project $Project -DefinitionId $DefinitionId -RunId $RunId -OwnerId $OwnerId -Base64EncodedToken $Base64EncodedToken
3336

3437
if ($existingLeases.count -ne 0) {
3538
LogDebug "Found $($existingLeases.count) leases, will delete them first."
3639

3740
foreach ($lease in $existingLeases.value) {
3841
LogDebug "Deleting lease: $($lease.leaseId)"
39-
Delete-RetentionLease -Organization $Organization -Project $Project -LeaseId $lease.leaseId -Base64EncodedAuthToken $encodedAuthToken
42+
Delete-RetentionLease -Organization $Organization -Project $Project -LeaseId $lease.leaseId -Base64EncodedToken $Base64EncodedToken
4043
}
4144

4245
}
43-
4446
LogDebug "Creating new lease on run: $RunId"
45-
$lease = Add-RetentionLease -Organization $Organization -Project $Project -DefinitionId $DefinitionId -RunId $RunId -OwnerId $OwnerId -DaysValid $DaysValid -Base64EncodedAuthToken $encodedAuthToken
47+
$lease = Add-RetentionLease -Organization $Organization -Project $Project -DefinitionId $DefinitionId -RunId $RunId -OwnerId $OwnerId -DaysValid $DaysValid -Base64EncodedToken $Base64EncodedToken
4648
LogDebug "Lease ID is: $($lease.value.leaseId)"

‎eng/common/scripts/Invoke-DevOpsAPI.ps1‎

Lines changed: 51 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,27 @@ function Get-Base64EncodedToken([string]$AuthToken)
1616
return $encodedAuthToken
1717
}
1818

19-
function Get-DevOpsApiHeaders ($Base64EncodedToken) {
20-
$headers = @{
21-
Authorization = "Basic $Base64EncodedToken"
19+
# The Base64EncodedToken would be from a PAT that was passed in and the header requires Basic authorization
20+
# The AccessToken would be the querying the Azure resource with the following command:
21+
# az account get-access-token --resource "499b84ac-1321-427f-aa17-267ca6975798" --query "accessToken" --output tsv
22+
# The header for an AccessToken requires Bearer authorization
23+
function Get-DevOpsApiHeaders {
24+
param (
25+
$Base64EncodedToken=$null,
26+
$BearerToken=$null
27+
)
28+
$headers = $null
29+
if (![string]::IsNullOrWhiteSpace($Base64EncodedToken)) {
30+
$headers = @{
31+
Authorization = "Basic $Base64EncodedToken"
32+
}
33+
} elseif (![string]::IsNullOrWhiteSpace($BearerToken)) {
34+
$headers = @{
35+
Authorization = "Bearer $BearerToken"
36+
}
37+
} else {
38+
LogError "Get-DevOpsApiHeaders::Unable to set the Authentication in the header because neither Base64EncodedToken nor BearerToken are set."
39+
exit 1
2240
}
2341
return $headers
2442
}
@@ -30,9 +48,8 @@ function Start-DevOpsBuild {
3048
$SourceBranch,
3149
[Parameter(Mandatory = $true)]
3250
$DefinitionId,
33-
[ValidateNotNullOrEmpty()]
34-
[Parameter(Mandatory = $true)]
35-
$Base64EncodedAuthToken,
51+
$Base64EncodedToken=$null,
52+
$BearerToken=$null,
3653
[Parameter(Mandatory = $false)]
3754
[string]$BuildParametersJson
3855
)
@@ -45,11 +62,13 @@ function Start-DevOpsBuild {
4562
parameters = $BuildParametersJson
4663
}
4764

65+
$headers = (Get-DevOpsApiHeaders -Base64EncodedToken $Base64EncodedToken -BearerToken $BearerToken)
66+
4867
return Invoke-RestMethod `
4968
-Method POST `
5069
-Body ($parameters | ConvertTo-Json) `
5170
-Uri $uri `
52-
-Headers (Get-DevOpsApiHeaders -Base64EncodedToken $Base64EncodedAuthToken) `
71+
-Headers $headers `
5372
-MaximumRetryCount 3 `
5473
-ContentType "application/json"
5574
}
@@ -62,21 +81,22 @@ function Update-DevOpsBuild {
6281
[Parameter(Mandatory = $true)]
6382
$BuildId,
6483
$Status, # pass canceling to cancel build
65-
[ValidateNotNullOrEmpty()]
66-
[Parameter(Mandatory = $true)]
67-
$Base64EncodedAuthToken
84+
$Base64EncodedToken=$null,
85+
$BearerToken=$null
6886
)
6987

7088
$uri = "$DevOpsAPIBaseURI" -F $Organization, $Project, "build", "builds/$BuildId", ""
7189
$parameters = @{}
7290

7391
if ($Status) { $parameters["status"] = $Status}
7492

93+
$headers = (Get-DevOpsApiHeaders -Base64EncodedToken $Base64EncodedToken -BearerToken $BearerToken)
94+
7595
return Invoke-RestMethod `
7696
-Method PATCH `
7797
-Body ($parameters | ConvertTo-Json) `
7898
-Uri $uri `
79-
-Headers (Get-DevOpsApiHeaders -Base64EncodedToken $Base64EncodedAuthToken) `
99+
-Headers $headers `
80100
-MaximumRetryCount 3 `
81101
-ContentType "application/json"
82102
}
@@ -88,9 +108,8 @@ function Get-DevOpsBuilds {
88108
$BranchName, # Should start with 'refs/heads/'
89109
$Definitions, # Comma seperated string of definition IDs
90110
$StatusFilter, # Comma seperated string 'cancelling, completed, inProgress, notStarted'
91-
[ValidateNotNullOrEmpty()]
92-
[Parameter(Mandatory = $true)]
93-
$Base64EncodedAuthToken
111+
$Base64EncodedToken=$null,
112+
$BearerToken=$null
94113
)
95114

96115
$query = ""
@@ -100,10 +119,12 @@ function Get-DevOpsBuilds {
100119
if ($StatusFilter) { $query += "statusFilter=$StatusFilter&" }
101120
$uri = "$DevOpsAPIBaseURI" -F $Organization, $Project , "build" , "builds", $query
102121

122+
$headers = (Get-DevOpsApiHeaders -Base64EncodedToken $Base64EncodedToken -BearerToken $BearerToken)
123+
103124
return Invoke-RestMethod `
104125
-Method GET `
105126
-Uri $uri `
106-
-Headers (Get-DevOpsApiHeaders -Base64EncodedToken $Base64EncodedAuthToken) `
127+
-Headers $headers `
107128
-MaximumRetryCount 3
108129
}
109130

@@ -112,15 +133,18 @@ function Delete-RetentionLease {
112133
$Organization,
113134
$Project,
114135
$LeaseId,
115-
$Base64EncodedAuthToken
136+
$Base64EncodedToken=$null,
137+
$BearerToken=$null
116138
)
117139

118140
$uri = "https://dev.azure.com/$Organization/$Project/_apis/build/retention/leases?ids=$LeaseId&api-version=6.0-preview.1"
119141

142+
$headers = (Get-DevOpsApiHeaders -Base64EncodedToken $Base64EncodedToken -BearerToken $BearerToken)
143+
120144
return Invoke-RestMethod `
121145
-Method DELETE `
122146
-Uri $uri `
123-
-Headers (Get-DevOpsApiHeaders -Base64EncodedToken $Base64EncodedAuthToken) `
147+
-Headers $headers `
124148
-MaximumRetryCount 3
125149
}
126150

@@ -131,15 +155,18 @@ function Get-RetentionLeases {
131155
$DefinitionId,
132156
$RunId,
133157
$OwnerId,
134-
$Base64EncodedAuthToken
158+
$Base64EncodedToken=$null,
159+
$BearerToken=$null
135160
)
136161

137162
$uri = "https://dev.azure.com/$Organization/$Project/_apis/build/retention/leases?ownerId=$OwnerId&definitionId=$DefinitionId&runId=$RunId&api-version=6.0-preview.1"
138163

164+
$headers = (Get-DevOpsApiHeaders -Base64EncodedToken $Base64EncodedToken -BearerToken $BearerToken)
165+
139166
return Invoke-RestMethod `
140167
-Method GET `
141168
-Uri $uri `
142-
-Headers (Get-DevOpsApiHeaders -Base64EncodedToken $Base64EncodedAuthToken) `
169+
-Headers $headers `
143170
-MaximumRetryCount 3
144171
}
145172

@@ -151,7 +178,8 @@ function Add-RetentionLease {
151178
$RunId,
152179
$OwnerId,
153180
$DaysValid,
154-
$Base64EncodedAuthToken
181+
$Base64EncodedToken=$null,
182+
$BearerToken=$null
155183
)
156184

157185
$parameter = @{}
@@ -165,12 +193,13 @@ function Add-RetentionLease {
165193

166194
$uri = "https://dev.azure.com/$Organization/$Project/_apis/build/retention/leases?api-version=6.0-preview.1"
167195

196+
$headers = (Get-DevOpsApiHeaders -Base64EncodedToken $Base64EncodedToken -BearerToken $BearerToken)
197+
168198
return Invoke-RestMethod `
169199
-Method POST `
170200
-Body "[$body]" `
171201
-Uri $uri `
172-
-Headers (Get-DevOpsApiHeaders -Base64EncodedToken $Base64EncodedAuthToken) `
202+
-Headers $headers `
173203
-MaximumRetryCount 3 `
174204
-ContentType "application/json"
175-
176205
}

‎eng/common/scripts/Queue-Pipeline.ps1‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -57,21 +57,20 @@ param(
5757

5858
[string]$VsoQueuedPipelines,
5959

60-
# Already base 64 encoded authentication token
61-
[string]$Base64EncodedAuthToken,
60+
# Unencoded authentication token from a PAT
61+
[string]$AuthToken=$null,
6262

63-
# Unencoded authentication token
64-
[string]$AuthToken,
63+
# Temp access token from the logged in az cli user for azure devops resource
64+
[string]$BearerToken=$null,
6565

6666
[Parameter(Mandatory = $false)]
6767
[string]$BuildParametersJson
6868
)
6969

7070
. (Join-Path $PSScriptRoot common.ps1)
71-
72-
if (!$Base64EncodedAuthToken)
73-
{
74-
$Base64EncodedAuthToken = Get-Base64EncodedToken $AuthToken
71+
$Base64EncodedToken=$null
72+
if (![string]::IsNullOrWhiteSpace($AuthToken)) {
73+
$Base64EncodedToken = Get-Base64EncodedToken $AuthToken
7574
}
7675

7776
# Skip if SourceBranch is empty because it we cannot generate a target branch
@@ -80,7 +79,7 @@ if ($CancelPreviousBuilds -and $SourceBranch)
8079
{
8180
try {
8281
$queuedBuilds = Get-DevOpsBuilds -BranchName "refs/heads/$SourceBranch" -Definitions $DefinitionId `
83-
-StatusFilter "inProgress, notStarted" -Base64EncodedAuthToken $Base64EncodedAuthToken
82+
-StatusFilter "inProgress, notStarted" -Base64EncodedToken $Base64EncodedToken -BearerToken $BearerToken
8483

8584
if ($queuedBuilds.count -eq 0) {
8685
LogDebug "There is no previous build still inprogress or about to start."
@@ -89,7 +88,7 @@ if ($CancelPreviousBuilds -and $SourceBranch)
8988
foreach ($build in $queuedBuilds.Value) {
9089
$buildID = $build.id
9190
LogDebug "Canceling build [ $($build._links.web.href) ]"
92-
Update-DevOpsBuild -BuildId $buildID -Status "cancelling" -Base64EncodedAuthToken $Base64EncodedAuthToken
91+
Update-DevOpsBuild -BuildId $buildID -Status "cancelling" -Base64EncodedToken $Base64EncodedToken -BearerToken $BearerToken
9392
}
9493
}
9594
catch {
@@ -104,7 +103,8 @@ try {
104103
-Project $Project `
105104
-SourceBranch $SourceBranch `
106105
-DefinitionId $DefinitionId `
107-
-Base64EncodedAuthToken $Base64EncodedAuthToken `
106+
-Base64EncodedToken $Base64EncodedToken `
107+
-BearerToken $BearerToken `
108108
-BuildParametersJson $BuildParametersJson
109109
}
110110
catch {

‎eng/pipelines/pipeline-queue-test.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
trigger: none
2+
3+
pr: none
4+
5+
jobs:
6+
- job: Run
7+
pool:
8+
name: azsdk-pool-mms-ubuntu-2204-general
9+
vmImage: ubuntu-22.04
10+
variables:
11+
ToolsCODEOWNERSLinterId: 6597
12+
steps:
13+
- template: /eng/common/pipelines/templates/steps/sparse-checkout.yml
14+
- task: AzureCLI@2
15+
displayName: Test Authenticate to OpenSource API and queue pipeline
16+
inputs:
17+
azureSubscription: opensource-api-connection
18+
scriptType: pscore
19+
scriptLocation: inlineScript
20+
inlineScript: |
21+
$accessToken = az account get-access-token --resource "499b84ac-1321-427f-aa17-267ca6975798" --query "accessToken" --output tsv
22+
eng/common/scripts/Queue-Pipeline.ps1 `
23+
-Organization "azure-sdk" `
24+
-Project "public" `
25+
-DefinitionId "$(ToolsCODEOWNERSLinterId)" `
26+
-BearerToken $accessToken
27+
28+
# # This task is going to become obsolete once the PATs go away
29+
# # the queueing PAT will be gone first but there's another PAT
30+
# # for queuing docs and this task is just testing the pipeline
31+
# # scripts. This task will need to be commented out or removed.
32+
# - task: PowerShell@2
33+
# displayName: Test Queue Pipeline with PAT
34+
# inputs:
35+
# pwsh: true
36+
# filePath: eng/common/scripts/Queue-Pipeline.ps1
37+
# arguments: >
38+
# -Organization "azure-sdk"
39+
# -Project "public"
40+
# -DefinitionId "$(ToolsCODEOWNERSLinterId)"
41+
# -AuthToken "$(azuresdk-azure-sdk-devops-build-queuing-pat)"
42+
43+
- task: PowerShell@2
44+
displayName: Test Retain pipeline run
45+
env:
46+
SYSTEM_ACCESSTOKEN: $(System.AccessToken)
47+
inputs:
48+
pwsh: true
49+
filePath: $(Build.SourcesDirectory)/eng/common/scripts/Add-RetentionLease.ps1
50+
arguments: >
51+
-Organization azure-sdk
52+
-Project $(System.TeamProject)
53+
-DefinitionId $(System.DefinitionId)
54+
-RunId $(Build.BuildId)
55+
-DaysValid 7
56+
-AccessToken $env:SYSTEM_ACCESSTOKEN
57+
-Debug

‎eng/pipelines/templates/steps/sync-directory.yml‎

Lines changed: 28 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -79,37 +79,43 @@ steps:
7979
-PushArgs "${{ parameters.PushArgs }}"
8080
-AmendCommit $True
8181
82-
- task: PowerShell@2
82+
- task: AzureCLI@2
8383
displayName: Queue template pipeline
8484
condition: and(succeeded(), ne(variables['${{repo}}-template-definition-id'], ''))
8585
inputs:
86-
pwsh: true
86+
azureSubscription: opensource-api-connection
87+
scriptType: pscore
88+
scriptLocation: inlineScript
89+
inlineScript: |
90+
$accessToken = az account get-access-token --resource "499b84ac-1321-427f-aa17-267ca6975798" --query "accessToken" --output tsv
91+
${{ parameters.ScriptDirectory }}/Queue-Pipeline.ps1 `
92+
-Organization "azure-sdk" `
93+
-Project "internal" `
94+
-SourceBranch "${{ parameters.UpstreamBranchName }}-ForTestPipeline" `
95+
-DefinitionId "$(${{repo}}-template-definition-id)" `
96+
-VsoQueuedPipelines "QUEUEDPIPELINES" `
97+
-CancelPreviousBuilds $True `
98+
-BearerToken $accessToken
8799
workingDirectory: ${{ parameters.WorkingDirectory }}
88-
filePath: ${{ parameters.ScriptDirectory }}/Queue-Pipeline.ps1
89-
arguments: >
90-
-Organization "azure-sdk"
91-
-Project "internal"
92-
-SourceBranch "${{ parameters.UpstreamBranchName }}-ForTestPipeline"
93-
-DefinitionId "$(${{repo}}-template-definition-id)"
94-
-VsoQueuedPipelines "QUEUEDPIPELINES"
95-
-CancelPreviousBuilds $True
96-
-AuthToken $(azuresdk-azure-sdk-devops-build-queuing-pat)
97100

98-
- task: PowerShell@2
101+
- task: AzureCLI@2
99102
displayName: Queue live-test template pipeline
100103
condition: and(succeeded(), ne(variables['${{repo}}-template-tests-definition-id'], ''))
101104
inputs:
102-
pwsh: true
105+
azureSubscription: opensource-api-connection
106+
scriptType: pscore
107+
scriptLocation: inlineScript
108+
inlineScript: |
109+
$accessToken = az account get-access-token --resource "499b84ac-1321-427f-aa17-267ca6975798" --query "accessToken" --output tsv
110+
${{ parameters.ScriptDirectory }}/Queue-Pipeline.ps1 `
111+
-Organization "azure-sdk" `
112+
-Project "internal" `
113+
-SourceBranch "${{ parameters.UpstreamBranchName }}-ForTestPipeline" `
114+
-DefinitionId "$(${{repo}}-template-tests-definition-id)" `
115+
-VsoQueuedPipelines "QUEUEDPIPELINES" `
116+
-CancelPreviousBuilds $True `
117+
-BearerToken $accessToken
103118
workingDirectory: ${{ parameters.WorkingDirectory }}
104-
filePath: ${{ parameters.ScriptDirectory }}/Queue-Pipeline.ps1
105-
arguments: >
106-
-Organization "azure-sdk"
107-
-Project "internal"
108-
-SourceBranch "${{ parameters.UpstreamBranchName }}-ForTestPipeline"
109-
-DefinitionId "$(${{repo}}-template-tests-definition-id)"
110-
-VsoQueuedPipelines "QUEUEDPIPELINES"
111-
-CancelPreviousBuilds $True
112-
-AuthToken $(azuresdk-azure-sdk-devops-build-queuing-pat)
113119

114120
- task: PowerShell@2
115121
displayName: Write Queued Pipeline Information to Tools PR

0 commit comments

Comments
 (0)
⚡