Transition to GitHub App auth, remove azuresdk-github-pat usage

eng/pipelines/aggregate-reports.yml

@@ -79,11 +79,13 @@ stages:
               python -m pip install -r scripts/repo_health_status_report/dev_requirements.txt
             displayName: 'Prep Environment'
 
+          - template: /eng/common/pipelines/templates/steps/login-to-github.yml
+
           - task: PythonScript@0
             condition: succeededOrFailed()
             env:
               SYSTEM_ACCESSTOKEN: $(System.AccessToken)
-              GH_TOKEN: $(azuresdk-github-pat)
+              GH_TOKEN: $(GH_TOKEN)
             inputs:
               scriptPath: 'scripts/repo_health_status_report/output_health_report.py'
             displayName: 'Generate Health Status Report'
@@ -95,7 +97,7 @@ stages:
           - task: PythonScript@0
             condition: succeededOrFailed()
             env:
-              GH_TOKEN: $(azuresdk-github-pat)
+              GH_TOKEN: $(GH_TOKEN)
             inputs:
               scriptPath: 'scripts/repo_type_completeness/generate_main_typescores.py'
             displayName: 'Update Type Completeness Scores'

eng/pipelines/conda-update-pipeline.yml

@@ -121,3 +121,4 @@ extends:
                       - [ ] After upload, delete the dummy libraries and make the new packages publicly available in Conda.
                       - [ ] Create an AKA link for new release logs here: http://aka.ms/
                     BaseBranchName: main
+                    AuthToken: ''

eng/pipelines/docindex.yml

@@ -116,6 +116,7 @@ jobs:
             TargetRepoName: $(DocRepoName)
             TargetRepoOwner: $(DocRepoOwner)
             WorkingDirectory: $(DocRepoLocation)
+            AuthToken: ''
 
         - task: AzureCLI@2
           displayName: Queue Docs CI build for main
@@ -200,6 +201,7 @@ jobs:
             WorkingDirectory: $(DocRepoLocation)
             ScriptDirectory: $(Build.SourcesDirectory)/eng/common/scripts
             PushArgs: -f
+            AuthToken: ''
 
         - task: AzureCLI@2
           displayName: Queue Docs CI build for daily branch

eng/pipelines/prepare-pipelines.yml

@@ -7,3 +7,4 @@ extends:
   template: /eng/common/pipelines/templates/jobs/prepare-pipelines.yml
   parameters:
     Repository: Azure/azure-sdk-for-python
+    AuthToken: ''

eng/pipelines/templates/jobs/ci.tests.yml

@@ -89,10 +89,12 @@ jobs:
           Write-Host "##vso[task.setvariable variable=DOTNET_ROOT]$dotnetroot"
         displayName: 'Set DOTNET_ROOT'
 
+    - template: /eng/common/pipelines/templates/steps/login-to-github.yml
+
     - template: /eng/common/pipelines/templates/steps/sparse-checkout.yml
       parameters:
         ${{ if endsWith(variables['Build.Repository.Name'], '-pr') }}:
-          TokenToUseForAuth: $(azuresdk-github-pat)
+          TokenToUseForAuth: $(GH_TOKEN)
         Paths:
           - '**'
 

eng/pipelines/templates/jobs/live.tests.yml

@@ -107,10 +107,12 @@ jobs:
       container: $[ variables['Container'] ]
 
     steps:
+      - template: /eng/common/pipelines/templates/steps/login-to-github.yml
+
       - template: /eng/common/pipelines/templates/steps/sparse-checkout.yml
         parameters:
           ${{ if endsWith(variables['Build.Repository.Name'], '-pr') }}:
-            TokenToUseForAuth: $(azuresdk-github-pat)
+            TokenToUseForAuth: $(GH_TOKEN)
           Paths:
             - '**'
 

eng/pipelines/templates/jobs/update_pr.yml

@@ -23,7 +23,9 @@ steps:
     python3 -m pip install -e $(Build.SourcesDirectory)/eng/tools/azure-sdk-tools[ghtools]
   displayName: 'Install Azure SDK tools'
 
+- template: /eng/common/pipelines/templates/steps/login-to-github.yml
+
 - script: python3 -m packaging_tools.update_pr -v --pr-number $(System.PullRequest.PullRequestNumber) --repo $(Build.Repository.Name)
   displayName: 'Update packaging of PR'
   env:
-    GH_TOKEN: $(azuresdk-github-pat)
+    GH_TOKEN: $(GH_TOKEN)

eng/pipelines/templates/stages/archetype-python-release.yml

@@ -96,6 +96,7 @@ stages:
                   ReleaseSha: $(Build.SourceVersion)
                   RepoId: Azure/azure-sdk-for-python
                   WorkingDirectory: $(System.DefaultWorkingDirectory)
+                  AuthToken: ''
 
           - ${{if ne(artifact.skipPublishPackage, 'true')}}:
             - deployment: PublishPackage
@@ -352,6 +353,7 @@ stages:
                   CommitMsg: "Increment package version after release of ${{ artifact.name }}"
                   PRTitle: "Increment version for ${{ parameters.ServiceDirectory }} releases"
                   CloseAfterOpenForTesting: '${{ parameters.TestPipeline }}'
+                  AuthToken: ''
 
           - ${{if and(eq(variables['Build.Reason'], 'Manual'), eq(variables['System.TeamProject'], 'internal'))}}:
             - template: /eng/pipelines/templates/jobs/smoke.tests.yml

eng/pipelines/templates/stages/python-analyze-weekly.yml

@@ -32,6 +32,9 @@ stages:
           - script: |
               python -m pip install -r eng/ci_tools.txt
             displayName: 'Prep Environment'
+
+          - template: /eng/common/pipelines/templates/steps/login-to-github.yml
+
           - task: PythonScript@0
             displayName: 'Run Pylint Next'
             continueOnError: true
@@ -44,7 +47,7 @@ stages:
                 --disablecov
                 --filter-type="Omit_management"
             env:
-              GH_TOKEN: $(azuresdk-github-pat)
+              GH_TOKEN: $(GH_TOKEN)
 
           - task: PythonScript@0
             displayName: 'Run MyPy Next'
@@ -57,7 +60,7 @@ stages:
                 --checks="next-mypy"
                 --disablecov
             env:
-              GH_TOKEN: $(azuresdk-github-pat)
+              GH_TOKEN: $(GH_TOKEN)
 
           - task: PythonScript@0
             displayName: 'Run Pyright Next'
@@ -70,7 +73,7 @@ stages:
                 --checks="next-pyright"
                 --disablecov
             env:
-              GH_TOKEN: $(azuresdk-github-pat)
+              GH_TOKEN: $(GH_TOKEN)
 
           - script: |
               python -m pip install PyGithub>=1.59.0
@@ -86,7 +89,7 @@ stages:
                 --service="${{ parameters.ServiceDirectory }}"
                 --disablecov
             env:
-              GH_TOKEN: $(azuresdk-github-pat)
+              GH_TOKEN: $(GH_TOKEN)
               SYSTEM_ACCESSTOKEN: $(System.AccessToken)
 
           - task: UsePythonVersion@0
@@ -108,4 +111,4 @@ stages:
                 --service="${{ parameters.ServiceDirectory }}"
                 --checks="next-sphinx"
             env:
-              GH_TOKEN: $(azuresdk-github-pat)
+              GH_TOKEN: $(GH_TOKEN)

eng/pipelines/templates/steps/build-package-artifacts.yml

@@ -25,10 +25,12 @@ parameters:
     default: []
 
 steps:
+  - template: /eng/common/pipelines/templates/steps/login-to-github.yml
+
   - template: /eng/common/pipelines/templates/steps/sparse-checkout.yml
     parameters:
       ${{ if endsWith(variables['Build.Repository.Name'], '-pr') }}:
-        TokenToUseForAuth: $(azuresdk-github-pat)
+        TokenToUseForAuth: $(GH_TOKEN)
       Paths:
         - '**'
 

eng/pipelines/templates/steps/verify-autorest.yml

@@ -46,3 +46,4 @@ steps:
           CommitMsg: "Regenerated code from nightly builds"
           PRTitle: "Automated autorest generation"
           PRBranchName: 'autorest-${{ parameters.ServiceDirectory }}'
+          AuthToken: ''

eng/pipelines/trigger-ml-sample-pipeline.yml

@@ -92,3 +92,4 @@ jobs:
         PRTitle: "SDK Samples Run generated from $(Build.BuildId)"
         WorkingDirectory: $(mlrepo)
         PRBody: "Check azureml samples against azure-sdk build $(Build.BuildId)."
+        AuthToken: ''

eng/pipelines/tsp-spec-sync.yml

@@ -53,4 +53,5 @@ extends:
 
                     Generated from workflow triggered by PR #$(System.PullRequest.PullRequestNumber).
                   CommitMsg: 'Auto-update TSP client generated code'
+                  AuthToken: ''
 

scripts/release_helper/release_helper.yml

@@ -44,6 +44,7 @@ jobs:
         versionSpec: '3.10'
         addToPath: true
         architecture: 'x64'
+    - template: /eng/common/pipelines/templates/steps/login-to-github.yml
     - bash: |
         script_path=$(pwd)/scripts/release_helper
         cd ..
@@ -58,7 +59,7 @@ jobs:
         git clone -b $(SPEC_BRANCH) https://github.com/Azure/azure-rest-api-specs.git $(pwd)/azure-rest-api-specs
 
         # import env variable
-        export AZURESDK_BOT_TOKEN=$(azuresdk-github-pat)
+        export AZURESDK_BOT_TOKEN=$(GH_TOKEN)
         export LANGUAGE=$(RUN_LANGUAGE)
         export SPEC_REPO=$(pwd)/azure-rest-api-specs/specification
         export TYPESPEC_JSON=$(pwd)/file-storage/data/typespec.json