Fix some auth issues with release creation. by iclanton · Pull Request #218 · SharePoint/spfx

iclanton · 2026-03-31T22:27:20Z

Description

Fixes 403 "Resource not accessible by integration" errors when creating GitHub releases.

Root cause: Git checkout extraheaders store credentials as Authorization: basic base64(x-access-token:ghs_xxx). This format is legacy Basic auth and is not supported for GitHub App installation tokens (ghs_xxx) — they require Authorization: token ghs_xxx. OAuth tokens happen to support both formats, which is why earlier runs with OAuth tokens succeeded.

Fix: getGitAuthorizationHeaderAsync now normalizes the value it returns via normalizeGitHubAuthorizationHeader, which decodes Basic auth credentials and re-emits them as token <value>. This means all callers — EmitGitHubVarsAction (which re-emits the token as the GitHubToken pipeline variable) and GitHubClient (which sets the header on every Octokit request) — automatically receive a properly-formatted token.

Also in this PR:

Splits emit-github-vars-and-tag-build into two actions (emit-github-vars and tag-build) so the release creation job no longer needs a git checkout just to get the token, and the release pipeline isn't tagged as a build
Extracts a GitHubTokenActionBase base class for actions that accept a --github-token / GITHUB_TOKEN parameter
Adds verbose ##vso[task.logissue type=error]-formatted error logging for GitHub API failures to aid future debugging
Adds unit tests for normalizeGitHubAuthorizationHeader, including an idempotency test

How was this tested

Multiple pipeline runs confirmed the 403 behavior. Build 12427 confirmed releases can be successfully created with the corrected token format.

Type of change

Bug fix
New feature
Template change (affects templates/ and examples/)
Docs/CI/pipeline change

The git checkout credential emitted by emit-github-vars-and-tag-build is generated by AzDO with limited scope (git operations only), which causes a 403 when used to create GitHub releases via the REST API. The 1ES pipeline template injects a properly-scoped GITHUB_TOKEN into the job environment via its 'Get GitHub Token' step; removing the env override lets that token be used instead. Also normalize raw bearer tokens (no space) to `token <value>` format in GitHubClient, so the code handles both the old `basic <base64>` format and a plain installation token interchangeably. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Adjusts the SPFx publishing pipeline and repo-toolbox GitHub client behavior so GitHub releases are created using the properly-scoped 1ES-provided GITHUB_TOKEN (instead of the AzDO git checkout credential that cannot create releases).

Changes:

Stop overriding GITHUB_TOKEN in spfx-esrp-publish.yaml so the 1ES-injected token is used for release creation.
Update GitHubClient to accept either a full Authorization header value or a raw token (auto-prefixing raw tokens).
Refresh CLI help text/snapshots to reflect the updated token semantics.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
tools/repo-toolbox/src/utilities/GitHubClient.ts	Normalizes auth input so raw tokens are converted into an `Authorization` header value for Octokit requests.
tools/repo-toolbox/src/cli/actions/CreateGitHubReleasesAction.ts	Updates `--github-token` parameter description to reflect that raw tokens are accepted.
tools/repo-toolbox/src/cli/test/snapshots/CommandLineHelp.test.ts.snap	Updates snapshot output for the revised help text.
common/config/azure-pipelines/spfx-esrp-publish.yaml	Removes the `GITHUB_TOKEN` override and unused `GitHubToken` variable mapping to allow 1ES token usage.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tools/repo-toolbox/src/utilities/GitHubClient.ts

Without a checkout, the 1ES PT 'Get GitHub Token' step has no repo context and does not inject GITHUB_TOKEN into the job environment. A fetchDepth: 1 checkout is sufficient to provide that context while minimizing overhead. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iclanton · 2026-03-31T22:55:32Z

Pushed a follow-up commit: the GITHUB_TOKEN env var wasn't being set because the 1ES PT "Get GitHub Token" step needs a checkout to know which repo/service connection to authenticate against. With checkout: none it has no context and skips token injection. Switching to checkout: self with fetchDepth: 1 (shallow clone, minimal overhead) gives it that context.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- emit-github-vars: emits GitHubRepoSlug and GitHubToken. Reads GITHUB_TOKEN from the 1ES PT environment (normalizing raw tokens to a full Authorization header value) with a fallback to the git checkout extraheader. - tag-build: emits BumpSha and tags the AzDO build. Only called from the bump-versions pipeline, not the publish pipeline. Introduces GitHubTokenActionBase as a shared base class for actions that need a GitHub token via the GITHUB_TOKEN environment variable. The publish pipeline now gets GitHubToken from emit-github-vars (which uses the 1ES PT token), eliminating the need for a shallow checkout in the Tag stage to trigger token injection. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

GitHub App installation tokens (ghs_xxx) require "Authorization: token ghs_xxx" and do not support the legacy "Authorization: basic base64(x-access-token:ghs_xxx)" format that git checkout extraheaders use. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… a normalized token Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tools/repo-toolbox/src/utilities/GitUtilities.ts

tools/repo-toolbox/src/cli/actions/GitHubTokenActionBase.ts

tools/repo-toolbox/src/cli/actions/CreateGitHubReleasesAction.ts

tools/repo-toolbox/src/cli/actions/EmitGitHubVarsAction.ts

tools/repo-toolbox/src/cli/actions/TagBuildAction.ts

tools/repo-toolbox/src/utilities/test/__snapshots__/GitUtilities.test.ts.snap

tools/repo-toolbox/src/cli/actions/TagBuildAction.ts

tools/repo-toolbox/src/cli/actions/EmitGitHubVarsAction.ts

tools/repo-toolbox/src/cli/actions/CreateGitHubReleasesAction.ts

Copilot AI review requested due to automatic review settings March 31, 2026 22:27

Copilot started reviewing on behalf of iclanton March 31, 2026 22:28 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

tools/repo-toolbox/src/utilities/GitHubClient.ts Outdated Show resolved Hide resolved

Add comment explaining why Tag stage needs a checkout

80d00b8

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings March 31, 2026 22:56

Copilot started reviewing on behalf of iclanton March 31, 2026 22:57 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

iclanton and others added 6 commits March 31, 2026 19:24

Add unit tests for normalizeGitHubAuthorizationHeader

a4f584a

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Log GitHub API error details before re-throwing

584641d

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fixup! Log GitHub API error details before re-throwing

ac473b2

Move normalization into getGitAuthorizationHeaderAsync so callers get…

5c93ebe

… a normalized token Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iclanton linked an issue Apr 1, 2026 that may be closed by this pull request

Set up GitHub Releases page to mirror npm package publishes #173

Open

iclanton changed the title ~~Use 1ES PT-provided GITHUB_TOKEN for release creation~~ Fix some auth issues with release creation. Apr 1, 2026

iclanton enabled auto-merge (squash) April 1, 2026 03:11

nick-pape requested changes Apr 1, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix some auth issues with release creation.#218

Fix some auth issues with release creation.#218
iclanton wants to merge 9 commits intomainfrom
iclanton/fix-github-releases-auth

iclanton commented Mar 31, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

iclanton commented Mar 31, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

iclanton commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

How was this tested

Type of change

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

iclanton commented Mar 31, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

iclanton commented Mar 31, 2026 •

edited

Loading