Backport Entra credential fallback for dn-bot-all-orgs-build-rw-code-rw (WI 10724)

[missymessa]

Summary

Backports the Entra-based authentication fallback from main (PR #16806) to release/9.0.

The V3 publishing pipeline was failing because dn-bot-all-orgs-build-rw-code-rw expired on 2026-05-14. This change adds the Entra credential fallback so the publish task uses AzurePipelinesCredential from the existing maestro-build-promotion service connection (with addSpnToEnvironment: true already set on this branch).

Changes

• Add Microsoft.DotNet.ArcadeAzureIntegration project (from main)
• Add Entra fallback to CreateAzdoClient in PublishArtifactsInManifestBase
• Remove /p:AzdoApiToken from publish.yml
• Remove PAT from publish-logs.yml redaction list
• Delete PAT entry from product-builds-engkeyvault.yaml

Work Item: https://dev.azure.com/dnceng/internal/_workitems/edit/10724

[Copilot]

Pull request overview

Backport of PR #16806 (Entra credential fallback) plus the Phase-2 YAML/secret manifest cleanup to release/9.0. The combined change allows PublishArtifactsInManifestBase.CreateAzdoClient to authenticate via Entra (AzurePipelinesCredential / Managed Identity / Workload Identity / Azure CLI) when AzdoApiToken is not supplied, and removes the now-expired dn-bot-all-orgs-build-rw-code-rw PAT from the V3 publish pipeline and secret manifest.

Changes:

• Add new Microsoft.DotNet.ArcadeAzureIntegration project (DefaultIdentityTokenCredential, AzureCliCredentialWithAzNoUpdateWrapper, TokenCredentialShortCache) and reference it from Microsoft.DotNet.Build.Tasks.Feed.
• Update CreateAzdoClient to fall back to bearer-token auth, add HasEntraCredentialsAvailable and relax AnyMissingRequiredBaseProperties accordingly.
• Drop AzdoApiToken usage from publish.yml, remove the PAT from the publish-logs.yml redaction list, and delete it from product-builds-engkeyvault.yaml.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/Microsoft.DotNet.ArcadeAzureIntegration/Microsoft.DotNet.ArcadeAzureIntegration.csproj	New project targeting $(NetMinimum) with conditional Azure.Identity reference.
src/Microsoft.DotNet.ArcadeAzureIntegration/DefaultIdentityTokenCredential.cs	Implements chained Entra credential with AzurePipelines/Workload/MI/AzureCLI options.
src/Microsoft.DotNet.ArcadeAzureIntegration/DefaultIdentityTokenCredentialOptions.cs	Options POCO for the new credential.
src/Microsoft.DotNet.ArcadeAzureIntegration/AzureCliCredentialWithAzNoUpdateWrapper.cs	Wrapper that disables az auto-update before first use.
src/Microsoft.DotNet.ArcadeAzureIntegration/TokenCredentialShortCache.cs	Short-lived in-process token cache wrapper.
src/Microsoft.DotNet.Build.Tasks.Feed/Microsoft.DotNet.Build.Tasks.Feed.csproj	Adds ProjectReference (excluded from source-only build).
src/Microsoft.DotNet.Build.Tasks.Feed/src/PublishArtifactsInManifestBase.cs	Adds Entra fallback in CreateAzdoClient, new HasEntraCredentialsAvailable, relaxed validation.
eng/publishing/v3/publish.yml	Removes /p:AzdoApiToken=... argument.
eng/common/core-templates/steps/publish-logs.yml	Removes PAT from binlog redaction list.
.vault-config/product-builds-engkeyvault.yaml	Deletes the expired PAT secret entry.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.