Merge branch 'main' into chore/removeRedundantPackage

Author: ramsessanchez

.azure-pipelines/command-metadata-refresh.yml

@@ -137,6 +137,7 @@ extends:
               targetType: inline
               script: |
                 . "$(System.DefaultWorkingDirectory)\tools\Versions\BumpModuleVersion.ps1" -BumpV1Module -BumpBetaModule -BumpAuthModule -Debug
+          - template: .azure-pipelines/common-templates/get-github-app-token.yml@self
           - task: Bash@3
             displayName: Push version bump changes
             env:
@@ -147,7 +148,7 @@ extends:
                 git status
                 git add "$(System.DefaultWorkingDirectory)/config/ModuleMetadata.json"
                 git commit -m 'Bump module versions after metadata generation.'
-                git push "https://$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git"
+                git push "https://x-access-token:$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git"
                 git status
                   
         - ${{ if eq(parameters.CreatePullRequest, true) }}:

.azure-pipelines/common-templates/create-pr.yml

@@ -16,6 +16,8 @@ parameters:
     default: ""
 
 steps:
+  - template: ./get-github-app-token.yml
+
   - task: PowerShell@2
     displayName: Create Pull Request for generated build
     env:
@@ -31,5 +33,5 @@ steps:
 
         git status
         gh auth login
-        git push "https://$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git"
+        git push "https://x-access-token:$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git"
         gh pr create -t $Title -b $Body -B $BaseBranchName -H $Head

.azure-pipelines/common-templates/download-openapi-docs.yml

@@ -78,6 +78,8 @@ steps:
       script: dotnet run
       workingDirectory: "$(System.DefaultWorkingDirectory)/tools/OpenApiInfoGenerator/OpenApiInfoGenerator"
 
+  - template: ./get-github-app-token.yml
+
   - task: Bash@3
     displayName: Commit downloaded files
     condition: and(succeeded(), ne(variables['ModuleGenerationList'], ''))
@@ -90,7 +92,7 @@ steps:
         git add .
         git commit -m 'Weekly OpenApiDocs Download.'
         git status
-        git push --set-upstream "https://$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git" $(Branch)
+        git push --set-upstream "https://x-access-token:$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git" $(Branch)
         git status
 
 # References

.azure-pipelines/common-templates/get-github-app-token.yml

@@ -0,0 +1,45 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+# Fetches the Microsoft Graph DevX GitHub App credentials from Key Vault and mints a short-lived
+# installation access token, exposing it to subsequent steps as the secret variable GITHUB_TOKEN.
+#
+# Include this template immediately before any step that pushes to GitHub or creates a pull
+# request. Downstream steps continue to reference $(GITHUB_TOKEN) exactly as before, but the value
+# is now a GitHub App installation token instead of a long-lived PAT. Because installation tokens
+# expire after ~1 hour, generate the token right before it is used rather than once per job.
+
+parameters:
+  - name: RepoName
+    type: string
+    default: microsoftgraph/msgraph-sdk-powershell
+
+steps:
+  - task: AzureKeyVault@2
+    displayName: "Azure Key Vault: Get GitHub App secrets"
+    inputs:
+      azureSubscription: "Federated AKV Managed Identity Connection"
+      KeyVaultName: akv-prod-eastus
+      SecretsFilter: "microsoft-graph-devx-bot-appid,microsoft-graph-devx-bot-privatekey"
+
+  - task: PowerShell@2
+    displayName: "Generate GitHub App installation token"
+    env:
+      GhAppId: $(microsoft-graph-devx-bot-appid)
+      GhAppKey: $(microsoft-graph-devx-bot-privatekey)
+    inputs:
+      pwsh: true
+      targetType: inline
+      errorActionPreference: stop
+      script: |
+        $token = & "$(System.DefaultWorkingDirectory)/scripts/Generate-Github-Token.ps1" `
+          -AppClientId $env:GhAppId `
+          -AppPrivateKeyContents $env:GhAppKey `
+          -Repository "${{ parameters.RepoName }}"
+        if ([string]::IsNullOrWhiteSpace($token)) {
+          throw "Failed to generate GitHub App installation token (empty result)."
+        }
+        # Mask the token so it can never surface in pipeline logs, then expose it to later steps.
+        Write-Host "##vso[task.setsecret]$token"
+        Write-Host "##vso[task.setvariable variable=GITHUB_TOKEN;issecret=true]$token"
+        Write-Host "Generated GitHub App installation token and set GITHUB_TOKEN."

.azure-pipelines/common-templates/install-sdk.yml

@@ -5,15 +5,24 @@ steps:
     targetType: 'inline'
     pwsh: true
     script: |
+          # Register the central CFS feed (network-isolation compliance) and install the SDK modules from it.
+          $token = ConvertTo-SecureString "$env:SYSTEM_ACCESSTOKEN" -AsPlainText -Force
+          $cred = [System.Management.Automation.PSCredential]::new("azure", $token)
+          $feedUrl = "https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/PowerShell_V2_Build/nuget/v2"
+          if (-not (Get-PSRepository -Name PowerShell_V2_Build -ErrorAction SilentlyContinue)) {
+              Register-PSRepository -Name PowerShell_V2_Build -SourceLocation $feedUrl -InstallationPolicy Trusted -Credential $cred
+          }
           try{
               # Installing Beta module.
-              Install-Module Microsoft.Graph.Beta -Repository PSGallery -Scope AllUsers -AcceptLicense -SkipPublisherCheck -Force -AllowClobber
+              Install-Module Microsoft.Graph.Beta -Repository PowerShell_V2_Build -Credential $cred -Scope AllUsers -AcceptLicense -SkipPublisherCheck -Force -AllowClobber
           }catch{
                 echo "Error when installing Beta"
           }
           try{
               # Installing V1 module.
-              Install-Module Microsoft.Graph -Repository PSGallery -Scope AllUsers -AcceptLicense -SkipPublisherCheck -Force -AllowClobber
+              Install-Module Microsoft.Graph -Repository PowerShell_V2_Build -Credential $cred -Scope AllUsers -AcceptLicense -SkipPublisherCheck -Force -AllowClobber
           }catch{
                 echo "Error when installing V1"
-          }
+          }
+  env:
+    SYSTEM_ACCESSTOKEN: $(System.AccessToken)

.azure-pipelines/config/credscan/credscan-suppressions.json

@@ -56,6 +56,12 @@
       ],
       "_justification": "[DeviceManagement.Actions] Examples contain random values recognized as secret"
     },
+    {
+      "file": [
+        "src\\DeviceManagement.Administration\\v1.0\\examples\\Update-MgDeviceManagementVirtualEndpointOnPremiseConnectionAdDomainPassword.md"
+      ],
+      "_justification": "[DeviceManagement.Administration] Examples contain random values recognized as secret"
+    },
     {
       "file": [
         "src\\Users.Actions\\v1.0\\examples\\Reset-MgUserAuthenticationMethodPassword.md"

.azure-pipelines/docker-image-refresh.yml

@@ -0,0 +1,93 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+#
+# Scheduled rebuild of the microsoftgraph/powershell container image.
+#
+# Why this pipeline exists:
+#   The release pipeline (sdk-release.yml) only builds and pushes this image on `v*` tags, so
+#   between releases the published digest goes stale and keeps accruing Ubuntu USN / PowerShell
+#   CVEs. That is the root cause of the two S360 "Replace Vulnerable Registry Reference" items.
+#   This lightweight pipeline rebuilds the image on a cadence against a patched base and pushes a
+#   fresh digest to :latest, keeping the registry copy patched without re-running the full release.
+#
+# Setup (one-time): register this YAML as a new pipeline definition in the
+#   "Graph Developer Experiences" ADO project, targeting the default branch.
+name: $(Date:yyyyMMdd)$(Rev:.r)_docker-image-refresh
+
+parameters:
+- name: WindowsPool
+  type: string
+  default: 1es-windows-ps-compute-m
+- name: LinuxPool
+  type: string
+  default: Azure-Pipelines-1ESPT-ExDShared
+
+variables:
+  REGISTRY: 'msgraphprodregistry.azurecr.io'
+  REGISTRY_NAME: 'msgraphprodregistry'   # ACR resource name (az acr build uses this, not the FQDN)
+  IMAGE_NAME: 'public/microsoftgraph/powershell'
+
+# Rebuild weekly so the image regularly picks up patched OS layers. `always: true` forces a run
+# even when there are no new commits (the whole point is to refresh the base image).
+schedules:
+- cron: "0 6 * * 1"   # 06:00 UTC every Monday
+  displayName: Weekly image refresh
+  branches:
+    include:
+    - main
+  always: true
+
+# Do not build on every push/PR; the release pipeline already handles tag-driven publishes.
+trigger: none
+pr: none
+
+resources:
+  repositories:
+  - repository: 1ESPipelineTemplates
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+    ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
+  parameters:
+    # The 1ES template injects an SDL/compliance stage that MUST run on a Windows pool, so the
+    # template-level pool is Windows. The actual container build overrides to a Linux pool at the
+    # job level below. (Same pattern as sdk-release.yml.)
+    pool: ${{ parameters.WindowsPool }}
+    settings:
+      networkIsolationPolicy: Permissive
+    customBuildTags:
+    - ES365AIMigrationTooling
+    stages:
+    - stage: RefreshDockerImage
+      displayName: 'Refresh docker image'
+      jobs:
+      - job: RebuildAndPush
+        displayName: 'Rebuild and push patched image'
+        pool:
+          name: ${{ parameters.LinuxPool }}
+          image: ubuntu-latest
+          os: linux
+        steps:
+        - checkout: self
+
+        # Build server-side with ACR Tasks: no local Docker daemon, no buildx/QEMU, and no
+        # Docker Hub dependency (which the network-isolated 1ES pool can't reach). ACR pulls the
+        # base image from MCR and pushes the result back to the registry.
+        - task: AzureCLI@2
+          displayName: 'Build and push patched image (ACR Tasks)'
+          inputs:
+            azureSubscription: 'ACR Images Push Service Connection'
+            scriptType: 'bash'
+            scriptLocation: 'inlineScript'
+            inlineScript: |
+              set -euo pipefail
+              formatted_date=$(date +"%Y%m%d%H%M%S")
+              echo "Rebuilding $(REGISTRY_NAME) / $(IMAGE_NAME) on a patched base via ACR Tasks"
+              az acr build \
+                --registry $(REGISTRY_NAME) \
+                --image "$(IMAGE_NAME):latest" \
+                --image "$(IMAGE_NAME):$formatted_date" \
+                --platform linux/amd64 \
+                "$(Build.SourcesDirectory)"

.azure-pipelines/generation-templates/generate-command-metadata.yml

@@ -17,6 +17,8 @@ steps:
       script: |
         . $(System.DefaultWorkingDirectory)/tools/PostGeneration/AuthModuleMetadata.ps1
 
+  - template: ../common-templates/get-github-app-token.yml
+
   - task: Bash@3
     displayName: Push command metadata
     enabled: true
@@ -28,5 +30,5 @@ steps:
         git status
         git add "$(System.DefaultWorkingDirectory)/src/Authentication/Authentication/custom/common/MgCommandMetadata.json"
         git commit -m 'Add generated MgCommandMetadata.json. [run ci]'
-        git push "https://$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git"
+        git push "https://x-access-token:$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git"
         git status

.azure-pipelines/generation-templates/generate-helpdocs-template.yml

@@ -82,6 +82,7 @@ extends:
             targetType: 'filePath'
             pwsh: true
             filePath: tools\ImportExamples.ps1
+        - template: .azure-pipelines/common-templates/get-github-app-token.yml@self
         - task: PowerShell@2
           displayName: Pushing to github
           env:
@@ -95,7 +96,7 @@ extends:
               git status
               git add .
               git commit -m "Updating examples"
-              git push --set-upstream https://$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git $(ComputeBranch.WeeklyExamplesBranch)
+              git push --set-upstream "https://x-access-token:$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git" $(ComputeBranch.WeeklyExamplesBranch)
               git status
         - template: .azure-pipelines/common-templates/create-pr.yml@self
           parameters: