Use an azure key vault to store Github tokens for automated pull requests & release creation (#41158)
* Experiment with keyvault * Iterate * Iterate * Prepare for PR
Blue committed
Jul 24, 2026 at 14:54 UTC
c82a43b6b757b3d4455c4e1a998e3cd13f76d624
3 files changed
+23
-1
.pipelines/flight-stage.yml
+8
-1
@@ -113,6 +113,13 @@ stages:
113
inputs:
114
artifactFeeds: 'wsl'
115
116
+ - task: AzureKeyVault@2
117
+ displayName: Fetch GitHub release token from Key Vault
118
+ inputs:
119
+ azureSubscription: 'Azure-Connection'
120
+ KeyVaultName: 'wsl-ci-key-vault'
121
+ SecretsFilter: 'GithubReleaseToken'
122
+
123
# Create a draft github release
124
- powershell: |
125
pip install --user -r tools/devops/requirements.txt
@@ -120,4 +127,4 @@ stages:
127
128
displayName: Create GitHub release
129
env:
123
- token: $(GITHUB_RELEASE_TOKEN)
\ No newline at end of file
130
+ token: $(GithubReleaseToken)
\ No newline at end of file
.pipelines/wsl-build-nightly-localization.yml
+8
@@ -55,6 +55,14 @@ steps:
55
inputs:
56
artifactFeeds: 'wsl'
57
58
+- task: AzureKeyVault@2
59
+ displayName: Fetch GitHub PR token from Key Vault
60
+ condition: and(succeeded(), in(variables['Build.Reason'], 'Schedule', 'Manual'))
61
+ inputs:
62
+ azureSubscription: 'Azure-Connection'
63
+ KeyVaultName: 'wsl-ci-key-vault'
64
+ SecretsFilter: 'GithubPRToken'
65
+
66
- powershell: |
67
pip install --user -r tools/devops/requirements.txt
68
python tools/devops/create-change.py . "$env:token" "WSL localization" "Localization change from build: $env:buildId" "user/localization/$env:buildId" "$env:targetBranch"
.pipelines/wsl-build-notice.yml
+7
@@ -53,6 +53,13 @@ steps:
53
inputs:
54
artifactFeeds: 'wsl'
55
56
+- task: AzureKeyVault@2
57
+ displayName: Fetch GitHub PR token from Key Vault
58
+ inputs:
59
+ azureSubscription: 'Azure-Connection'
60
+ KeyVaultName: 'wsl-ci-key-vault'
61
+ SecretsFilter: 'GithubPRToken'
62
+
63
- powershell: |
64
pip install --user -r tools/devops/requirements.txt
65
python tools/devops/create-change.py . "$env:token" "WSL notice" "Notice change from build: $env:buildId" "user/notice/$env:buildId" "$env:targetBranch"