PAT Migration: dn-bot-dnceng-public-build-r (telemetry)

.vault-config/shared/telemetry-secrets.yaml

@@ -1,9 +1,7 @@
+## DEPRECATED — Migrated to Managed Identity (telemetry-service-identity) in AB#10138.
+## The telemetry service now uses Entra bearer tokens for dnceng-public.
+## Remove this entry and the corresponding Key Vault secrets after production validation.
 dn-bot-dnceng-public-build-r:
-  type: azure-devops-access-token
+  type: text
   parameters:
-    domainAccountName: dn-bot
-    domainAccountSecret:
-      location: helixkv
-      name: dn-bot-account-redmond
-    organizations: dnceng-public
-    scopes: build
+    description: "DEPRECATED: replaced by telemetry-service-identity MI (AB#10138)"

src/Telemetry/AzureDevOpsClient.PostDeploymentTests/TelemetryManagedIdentityTests.cs

@@ -89,6 +89,35 @@ public async Task ManagedIdentity_CanListBuilds_FromDncengInternal()
         }
     }
 
+    /// <summary>
+    /// Validates that the Managed Identity can acquire a bearer token for
+    /// Azure DevOps and successfully list builds from dnceng-public/public.
+    /// </summary>
+    [Test]
+    public async Task ManagedIdentity_CanListBuilds_FromDncengPublic()
+    {
+        var options = new AzureDevOpsClientOptions
+        {
+            Organization = "dnceng-public",
+            ManagedIdentityClientId = "placeholder-activates-bearer-path",
+            MaxParallelRequests = 1,
+        };
+
+        var client = new AzureDevOpsClient(options, _logger, new SimpleHttpClientFactory(), _credential);
+
+        var builds = await client.ListBuilds("public", CancellationToken.None, limit: 3);
+
+        Assert.That(builds, Is.Not.Null);
+        Assert.That(builds.Length, Is.GreaterThan(0),
+            "Expected at least one build from dnceng-public/public using bearer token auth");
+
+        TestContext.Out.WriteLine($"Retrieved {builds.Length} build(s) from dnceng-public via Managed Identity:");
+        foreach (var build in builds)
+        {
+            TestContext.Out.WriteLine($"  Build #{build.Id} — {build.Definition?.Name} — {build.Status}");
+        }
+    }
+
     /// <summary>
     /// Validates that the Managed Identity can read build timeline data,
     /// which is the core operation the telemetry service performs.

src/Telemetry/AzureDevOpsTimeline/.config/settings.Production.json

@@ -6,6 +6,9 @@
     "AzureDevOpsSettings": {
         "dnceng": {
             "ManagedIdentityClientId": "13eb78dc-2e79-4ae1-afbf-f95c5b1d2a4c"
+        },
+        "dnceng-public": {
+            "ManagedIdentityClientId": "13eb78dc-2e79-4ae1-afbf-f95c5b1d2a4c"
         }
     },
     "KustoTimelineTelemetry": {

src/Telemetry/AzureDevOpsTimeline/.config/settings.Staging.json

@@ -6,6 +6,9 @@
     "AzureDevOpsSettings": {
         "dnceng": {
             "ManagedIdentityClientId": "c05abe9e-b183-4c19-a7c3-6512f976548f"
+        },
+        "dnceng-public": {
+            "ManagedIdentityClientId": "c05abe9e-b183-4c19-a7c3-6512f976548f"
         }
     },
     "KustoTimelineTelemetry": {

src/Telemetry/AzureDevOpsTimeline/.config/settings.json

@@ -29,7 +29,6 @@
     },
     "dnceng-public": {
       "Organization": "dnceng-public",
-      "AccessToken": "[vault(dn-bot-dnceng-public-build-r]",
       "MaxParallelRequests": 4
     }
   }