Add branch-scoped push trigger to probe workflow #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: canary-feed-oidc-probe | |
| # THROWAWAY Phase 0 probe. Validates that id-cpd-ci (via the OIDC federated | |
| # credential on environment:cicd) can mint an Azure DevOps token and publish to | |
| # the internal copilot-canary-spike npm feed. Delete once Phase 0 is proven. | |
| on: | |
| push: | |
| branches: [mackinnonbuck-canary-oidc-probe] | |
| workflow_dispatch: | |
| permissions: | |
| id-token: write # for azure/login OIDC | |
| contents: read # for actions/checkout | |
| jobs: | |
| probe: | |
| runs-on: ubuntu-latest | |
| environment: cicd # MUST match federated credential subject repo:github/copilot-sdk:environment:cicd | |
| steps: | |
| - name: Azure Login (OIDC -> id-cpd-ci) | |
| uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 | |
| with: | |
| client-id: "${{ vars.CPD_ID_CLIENT_ID }}" # id-cpd-ci | |
| tenant-id: "${{ vars.CPD_ID_TENANT_ID }}" | |
| allow-no-subscriptions: true | |
| - name: Mint Azure DevOps token | |
| id: adotoken | |
| run: | | |
| TOKEN=$(az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query accessToken -o tsv) | |
| echo "::add-mask::$TOKEN" | |
| echo "token=$TOKEN" >> "$GITHUB_OUTPUT" | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - name: Publish throwaway package to spike feed | |
| env: | |
| FEED_TOKEN: ${{ steps.adotoken.outputs.token }} | |
| run: | | |
| set -euo pipefail | |
| WORK="$(mktemp -d)"; cd "$WORK" | |
| VERSION="0.0.0-ci.${{ github.run_number }}" | |
| cat > package.json <<JSON | |
| { "name": "@copilot-canary-spike/ci-probe", "version": "${VERSION}", "description": "OIDC CI round-trip probe" } | |
| JSON | |
| cat > .npmrc <<EOF | |
| registry=https://pkgs.dev.azure.com/devdiv/DevDiv/_packaging/copilot-canary-spike/npm/registry/ | |
| //pkgs.dev.azure.com/devdiv/DevDiv/_packaging/copilot-canary-spike/npm/registry/:_authToken=${FEED_TOKEN} | |
| //pkgs.dev.azure.com/devdiv/DevDiv/_packaging/copilot-canary-spike/npm/:_authToken=${FEED_TOKEN} | |
| EOF | |
| npm publish | |
| echo "Published @copilot-canary-spike/ci-probe@${VERSION}" | |
| - name: Read back (fresh install) | |
| env: | |
| FEED_TOKEN: ${{ steps.adotoken.outputs.token }} | |
| run: | | |
| set -euo pipefail | |
| WORK="$(mktemp -d)"; cd "$WORK" | |
| VERSION="0.0.0-ci.${{ github.run_number }}" | |
| cat > .npmrc <<EOF | |
| registry=https://pkgs.dev.azure.com/devdiv/DevDiv/_packaging/copilot-canary-spike/npm/registry/ | |
| //pkgs.dev.azure.com/devdiv/DevDiv/_packaging/copilot-canary-spike/npm/registry/:_authToken=${FEED_TOKEN} | |
| //pkgs.dev.azure.com/devdiv/DevDiv/_packaging/copilot-canary-spike/npm/:_authToken=${FEED_TOKEN} | |
| EOF | |
| npm view "@copilot-canary-spike/ci-probe@${VERSION}" version | |
| npm install "@copilot-canary-spike/ci-probe@${VERSION}" --no-save | |
| test -f node_modules/@copilot-canary-spike/ci-probe/package.json && echo "READBACK OK" |