Use service connection credentials from git config for GitHub API calls

Author: iclanton

common/config/azure-pipelines/bump-decoupled-deps.yaml

@@ -113,6 +113,13 @@ extends:
                   REPO_SLUG=$(git remote get-url origin | sed -E 's#.*github\.com[:/](.+/[^.]+)(\.git)?$#\1#')
                   echo "Repository: ${REPO_SLUG}"
 
+                  # Extract the authorization header that AzDO configured via persistCredentials
+                  AUTH_HEADER=$(git config --get-regexp 'http\..*\.extraheader' | head -1 | sed 's/^[^ ]* //')
+                  if [ -z "$AUTH_HEADER" ]; then
+                    echo "##[error]Could not extract authorization header from git config"
+                    exit 1
+                  fi
+
                   PR_TITLE="$(CommitMessage)"
                   PR_BODY="Automated PR to bump decoupled local dependencies to the latest published versions."
                   API_BASE="https://api.github.com/repos/${REPO_SLUG}"
@@ -136,22 +143,22 @@ extends:
                   # Check if a PR already exists for this branch
                   OWNER=$(echo "${REPO_SLUG}" | cut -d/ -f1)
                   EXISTING_PR=$(github_api \
-                    -H "Authorization: token ${GITHUB_TOKEN}" \
+                    -H "$AUTH_HEADER" \
                     -H "Accept: application/vnd.github+json" \
                     "${API_BASE}/pulls?head=${OWNER}:$(BranchName)&state=open" \
                     | jq '.[0].number // empty')
 
                   if [ -n "$EXISTING_PR" ]; then
                     echo "Updating existing PR #${EXISTING_PR}"
                     github_api -X PATCH \
-                      -H "Authorization: token ${GITHUB_TOKEN}" \
+                      -H "$AUTH_HEADER" \
                       -H "Accept: application/vnd.github+json" \
                       "${API_BASE}/pulls/${EXISTING_PR}" \
                       -d "$(jq -n --arg body "$PR_BODY" '{body: $body}')"
                   else
                     echo "Creating new PR"
                     github_api -X POST \
-                      -H "Authorization: token ${GITHUB_TOKEN}" \
+                      -H "$AUTH_HEADER" \
                       -H "Accept: application/vnd.github+json" \
                       "${API_BASE}/pulls" \
                       -d "$(jq -n \
@@ -163,5 +170,3 @@ extends:
                   fi
                 displayName: 'Create or update GitHub PR'
                 condition: and(succeeded(), eq(variables.HasChanges, 'true'))
-                env:
-                  GITHUB_TOKEN: $(GitHubToken)