Use an azure key vault to store Github tokens for automated pull requests & release creation - #41158
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Updates WSLâs Azure Pipelines definitions to source GitHub automation tokens from an Azure Key Vault instead of pipeline variables, aligning credential storage with centralized secret management.
Changes:
- Added
AzureKeyVault@2steps to retrieveGithubPRTokenfor automated PR creation in the notice and nightly localization pipelines. - Added
AzureKeyVault@2step to retrieveGithubReleaseTokenfor automated GitHub release creation in the flight stage. - Updated the release-creation step to use the Key Vault-provided variable name (
$(GithubReleaseToken)).
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .pipelines/wsl-build-notice.yml | Fetches GithubPRToken from Key Vault before running the automated âcreate changeâ PR step. |
| .pipelines/wsl-build-nightly-localization.yml | Fetches GithubPRToken from Key Vault (gated to Schedule/Manual) for automated localization PR creation. |
| .pipelines/flight-stage.yml | Fetches GithubReleaseToken from Key Vault and wires it into the GitHub release creation step. |
Ben Hillis (benhillis)
approved these changes
Jul 23, 2026
Blue (OneBlue)
added a commit
that referenced
this pull request
Aug 14, 2026
* Mount plugin folders on behalf of the user owning the wsl session (#41331) * Ignore GSL warning (#40560) * Use an azure key vault to store Github tokens for automated pull requests & release creation (#41158) * Experiment with keyvault * Iterate * Iterate * Prepare for PR * Fix bad merge --------- Co-authored-by: JohnMcPMS <johnmcp@microsoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of the Pull Request
PR Checklist
Detailed Description of the Pull Request / Additional comments
Note that the service connection & keyvault name cannot be secrets, since they need to be known compile time
Validation Steps Performed