Use GitHub App auth in spec-gen-sdk pipeline (#44291)

* Use GitHub App auth in spec-gen-sdk pipeline

Fetch GitHub login scripts in internal PR pipeline runs and use the resulting GH_TOKEN for sparse checkout and SDK pull request creation instead of the legacy PAT variable.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add comment to tspconfig.yaml

* use self checkout approach

* Set token for push change step

* Remove comment from tspconfig.yaml

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: raych1

eng/pipelines/templates/stages/archetype-spec-gen-sdk.yml

@@ -64,8 +64,6 @@ stages:
       os: linux
 
     steps:
-      - checkout: none
-
       - pwsh: |
           $tspConfigPathPattern = '^specification\/([^\/]+\/)+tspconfig\.yaml$'
           $readmePathPattern = '^specification\/([^\/]+\/){2,}readme\.md$'
@@ -178,6 +176,22 @@ stages:
             Write-Host "Will use commitish for SDK repo checkout: '$checkoutCommitish'"
           displayName: "Validate and update SDK repository commitish"
 
+      # In the internal '-pr' flow the spec/SDK repos are private, so the sparse-checkout below
+      # needs a GitHub App token (GH_TOKEN) minted by login-to-github. That login script lives in
+      # this repo, so it must be available first. Use 'checkout: self' (authenticated by the
+      # pipeline's GitHub service connection) at the default path so System.DefaultWorkingDirectory
+      # stays at $(Pipeline.Workspace)/s; sparse-checkout keeps the footprint to eng/common/scripts.
+      - ${{ if and(eq(variables['System.TeamProject'], 'internal'), endsWith(variables['Build.Repository.Name'], '-pr')) }}:
+        - checkout: self
+          displayName: 'Checkout eng/common/scripts for GitHub login'
+          sparseCheckoutDirectories: eng/common/scripts
+          fetchDepth: 1
+        - template: /eng/common/pipelines/templates/steps/login-to-github.yml
+          parameters:
+            ScriptDirectory: $(System.DefaultWorkingDirectory)/eng/common/scripts
+      - ${{ else }}:
+        - checkout: none
+
       - template: /eng/common/pipelines/templates/steps/sparse-checkout.yml
         parameters:
           Paths:
@@ -195,7 +209,7 @@ stages:
               WorkingDirectory: $(SdkRepoDirectory)
           SkipCheckoutNone: true
           ${{ if and(eq(variables['System.TeamProject'], 'internal'), endsWith(variables['Build.Repository.Name'], '-pr')) }}:
-            TokenToUseForAuth: $(azuresdk-github-pat)
+            TokenToUseForAuth: $(GH_TOKEN)
             PreserveAuthToken: true
 
       - task: UseNode@1
@@ -290,6 +304,10 @@ stages:
           CustomCondition: and(succeededOrFailed(), ne(variables['StagedArtifactsFolder'], ''))
 
       - ${{ if and(eq(variables['System.TeamProject'], 'internal'), eq(parameters.CreatePullRequest, true), ne(variables['Build.Reason'], 'PullRequest')) }}:
+        - template: /eng/common/pipelines/templates/steps/login-to-github.yml
+          parameters:
+            ScriptDirectory: $(SdkRepoDirectory)/eng/common/scripts
+
         - pwsh: |
             $sdkPrBranchName = "$(PrBranch)-$(Build.BuildId)"
             $sdkRepoBranch = '${{ parameters.SdkRepoBranch }}'
@@ -325,6 +343,7 @@ stages:
             TargetRepoName: $(SdkRepoName)
             WorkingDirectory: $(SdkRepoDirectory)
             ScriptDirectory: $(SdkRepoDirectory)/eng/common/scripts
+            AuthToken: $(GH_TOKEN)
 
         - ${{ if eq(parameters.ForceCreateEvenWithFailures, true) }}:
           - pwsh: |
@@ -348,7 +367,7 @@ stages:
               -BaseBranch "main"
               -PROwner "$(SdkRepoOwner)"
               -PRBranch "$(SdkPullRequestSourceBranch)"
-              -AuthToken "$(azuresdk-github-pat)"
+              -AuthToken "$(GH_TOKEN)"
               -PRTitle "$(PrTitle)-generated-from-$(Build.DefinitionName)-$(Build.BuildId)"
               -PRBody "$(GeneratedSDKInformation)  $(ReleasePlanInfo)"
               -OpenAsDraft $${{ not(endsWith(parameters.TriggerSource, '-release')) }}