use oidc

build/azure-pipelines/common/createBuild.ts

@@ -3,7 +3,7 @@
  *  Licensed under the MIT License. See License.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
 
-import { ClientSecretCredential } from '@azure/identity';
+import { ClientAssertionCredential } from '@azure/identity';
 import { CosmosClient } from '@azure/cosmos';
 import { retry } from './retry';
 
@@ -47,7 +47,7 @@ async function main(): Promise<void> {
 		updates: {}
 	};
 
-	const aadCredentials = new ClientSecretCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, process.env['AZURE_CLIENT_SECRET']!);
+	const aadCredentials = new ClientAssertionCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, () => Promise.resolve(process.env['AZURE_ID_TOKEN']!));
 	const client = new CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT']!, aadCredentials });
 	const scripts = client.database('builds').container(quality).scripts;
 	await retry(() => scripts.storedProcedure('createBuild').execute('', [{ ...build, _partitionKey: '' }]));

build/azure-pipelines/common/publish.ts

@@ -12,7 +12,7 @@ import * as yauzl from 'yauzl';
 import * as crypto from 'crypto';
 import { retry } from './retry';
 import { CosmosClient } from '@azure/cosmos';
-import { ClientSecretCredential } from '@azure/identity';
+import { ClientSecretCredential, ClientAssertionCredential } from '@azure/identity';
 import * as cp from 'child_process';
 import * as os from 'os';
 import { Worker, isMainThread, workerData } from 'node:worker_threads';
@@ -674,7 +674,7 @@ async function processArtifact(artifact: Artifact, artifactFilePath: string): Pr
 
 	await retry(async (attempt) => {
 		log(`Creating asset in Cosmos DB (attempt ${attempt})...`);
-		const aadCredentials = new ClientSecretCredential(e('AZURE_TENANT_ID'), e('AZURE_CLIENT_ID'), e('AZURE_CLIENT_SECRET'));
+		const aadCredentials = new ClientAssertionCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, () => Promise.resolve(process.env['AZURE_ID_TOKEN']!));
 		const client = new CosmosClient({ endpoint: e('AZURE_DOCUMENTDB_ENDPOINT'), aadCredentials });
 		const scripts = client.database('builds').container(quality).scripts;
 		await scripts.storedProcedure('createAsset').execute('', [commit, asset, true]);

build/azure-pipelines/common/releaseBuild.ts

@@ -3,7 +3,7 @@
  *  Licensed under the MIT License. See License.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
 
-import { ClientSecretCredential } from '@azure/identity';
+import { ClientAssertionCredential } from '@azure/identity';
 import { CosmosClient } from '@azure/cosmos';
 import { retry } from './retry';
 
@@ -45,7 +45,7 @@ async function main(force: boolean): Promise<void> {
 	const commit = getEnv('BUILD_SOURCEVERSION');
 	const quality = getEnv('VSCODE_QUALITY');
 
-	const aadCredentials = new ClientSecretCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, process.env['AZURE_CLIENT_SECRET']!);
+	const aadCredentials = new ClientAssertionCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, () => Promise.resolve(process.env['AZURE_ID_TOKEN']!));
 	const client = new CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT']!, aadCredentials });
 
 	if (!force) {

build/azure-pipelines/product-compile.yml

@@ -138,14 +138,14 @@ steps:
         inlineScript: |
           Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
           Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
-          Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_SECRET;issecret=true]$env:servicePrincipalKey"
+          Write-Host "##vso[task.setvariable variable=AZURE_ID_TOKEN;issecret=true]$env:idToken"
 
     - script: |
         set -e
         AZURE_STORAGE_ACCOUNT="vscodeweb" \
         AZURE_TENANT_ID="$(AZURE_TENANT_ID)" \
         AZURE_CLIENT_ID="$(AZURE_CLIENT_ID)" \
-        AZURE_CLIENT_SECRET="$(AZURE_CLIENT_SECRET)" \
+        AZURE_ID_TOKEN="$(AZURE_ID_TOKEN)" \
           node build/azure-pipelines/upload-sourcemaps
       displayName: Upload sourcemaps to Azure
 
@@ -154,7 +154,7 @@ steps:
         AZURE_STORAGE_ACCOUNT="ticino" \
         AZURE_TENANT_ID="$(AZURE_TENANT_ID)" \
         AZURE_CLIENT_ID="$(AZURE_CLIENT_ID)" \
-        AZURE_CLIENT_SECRET="$(AZURE_CLIENT_SECRET)" \
+        AZURE_ID_TOKEN="$(AZURE_ID_TOKEN)" \
           node build/azure-pipelines/upload-sourcemaps
       displayName: Upload sourcemaps to Azure (Deprecated)
 

build/azure-pipelines/product-publish.yml

@@ -45,7 +45,7 @@ steps:
       inlineScript: |
         Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
         Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
-        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_SECRET;issecret=true]$env:servicePrincipalKey"
+        Write-Host "##vso[task.setvariable variable=AZURE_ID_TOKEN;issecret=true]$env:idToken"
 
   - pwsh: |
       . build/azure-pipelines/win32/exec.ps1
@@ -61,7 +61,7 @@ steps:
     env:
       AZURE_TENANT_ID: "$(AZURE_TENANT_ID)"
       AZURE_CLIENT_ID: "$(AZURE_CLIENT_ID)"
-      AZURE_CLIENT_SECRET: "$(AZURE_CLIENT_SECRET)"
+      AZURE_ID_TOKEN: "$(AZURE_ID_TOKEN)"
     displayName: Create build if it hasn't been created before
 
   - pwsh: |
@@ -87,7 +87,7 @@ steps:
       GITHUB_TOKEN: "$(github-distro-mixin-password)"
       AZURE_TENANT_ID: "$(AZURE_TENANT_ID)"
       AZURE_CLIENT_ID: "$(AZURE_CLIENT_ID)"
-      AZURE_CLIENT_SECRET: "$(AZURE_CLIENT_SECRET)"
+      AZURE_ID_TOKEN: "$(AZURE_ID_TOKEN)"
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
       RELEASE_TENANT_ID: "$(PRSS_RELEASE_TENANT_ID)"
       RELEASE_CLIENT_ID: "$(PRSS_RELEASE_CLIENT_ID)"

build/azure-pipelines/product-release.yml

@@ -19,18 +19,16 @@ steps:
       inlineScript: |
         Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
         Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
-        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_SECRET;issecret=true]$env:servicePrincipalKey"
+        Write-Host "##vso[task.setvariable variable=AZURE_ID_TOKEN;issecret=true]$env:idToken"
 
-  - script: |
-      set -e
-      npm ci
+  - script: npm ci
     workingDirectory: build
     displayName: Install /build dependencies
 
   - script: |
       set -e
       AZURE_TENANT_ID="$(AZURE_TENANT_ID)" \
       AZURE_CLIENT_ID="$(AZURE_CLIENT_ID)" \
-      AZURE_CLIENT_SECRET="$(AZURE_CLIENT_SECRET)" \
-      node build/azure-pipelines/common/releaseBuild.js ${{ parameters.VSCODE_RELEASE }}
+      AZURE_ID_TOKEN="$(AZURE_ID_TOKEN)" \
+        node build/azure-pipelines/common/releaseBuild.js ${{ parameters.VSCODE_RELEASE }}
     displayName: Release build

build/azure-pipelines/upload-cdn.ts

@@ -9,11 +9,11 @@ import * as vfs from 'vinyl-fs';
 import * as filter from 'gulp-filter';
 import * as gzip from 'gulp-gzip';
 import * as mime from 'mime';
-import { ClientSecretCredential } from '@azure/identity';
+import { ClientAssertionCredential } from '@azure/identity';
 const azure = require('gulp-azure-storage');
 
 const commit = process.env['BUILD_SOURCEVERSION'];
-const credential = new ClientSecretCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, process.env['AZURE_CLIENT_SECRET']!);
+const credential = new ClientAssertionCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, () => Promise.resolve(process.env['AZURE_ID_TOKEN']!));
 
 mime.define({
 	'application/typescript': ['ts'],

build/azure-pipelines/upload-nlsmetadata.ts

@@ -8,13 +8,13 @@ import * as Vinyl from 'vinyl';
 import * as vfs from 'vinyl-fs';
 import * as merge from 'gulp-merge-json';
 import * as gzip from 'gulp-gzip';
-import { ClientSecretCredential } from '@azure/identity';
+import { ClientAssertionCredential } from '@azure/identity';
 import path = require('path');
 import { readFileSync } from 'fs';
 const azure = require('gulp-azure-storage');
 
 const commit = process.env['BUILD_SOURCEVERSION'];
-const credential = new ClientSecretCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, process.env['AZURE_CLIENT_SECRET']!);
+const credential = new ClientAssertionCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, () => Promise.resolve(process.env['AZURE_ID_TOKEN']!));
 
 interface NlsMetadata {
 	keys: { [module: string]: string };

build/azure-pipelines/upload-sourcemaps.ts

@@ -10,12 +10,12 @@ import * as vfs from 'vinyl-fs';
 import * as util from '../lib/util';
 // @ts-ignore
 import * as deps from '../lib/dependencies';
-import { ClientSecretCredential } from '@azure/identity';
+import { ClientAssertionCredential } from '@azure/identity';
 const azure = require('gulp-azure-storage');
 
 const root = path.dirname(path.dirname(__dirname));
 const commit = process.env['BUILD_SOURCEVERSION'];
-const credential = new ClientSecretCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, process.env['AZURE_CLIENT_SECRET']!);
+const credential = new ClientAssertionCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, () => Promise.resolve(process.env['AZURE_ID_TOKEN']!));
 
 // optionally allow to pass in explicit base/maps to upload
 const [, , base, maps] = process.argv;

build/azure-pipelines/web/product-build-web.yml

@@ -120,14 +120,14 @@ steps:
       inlineScript: |
         Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
         Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
-        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_SECRET;issecret=true]$env:servicePrincipalKey"
+        Write-Host "##vso[task.setvariable variable=AZURE_ID_TOKEN;issecret=true]$env:idToken"
 
   - script: |
       set -e
       AZURE_STORAGE_ACCOUNT="vscodeweb" \
       AZURE_TENANT_ID="$(AZURE_TENANT_ID)" \
       AZURE_CLIENT_ID="$(AZURE_CLIENT_ID)" \
-      AZURE_CLIENT_SECRET="$(AZURE_CLIENT_SECRET)" \
+      AZURE_ID_TOKEN="$(AZURE_ID_TOKEN)" \
         node build/azure-pipelines/upload-cdn
     displayName: Upload to CDN
 
@@ -136,7 +136,7 @@ steps:
       AZURE_STORAGE_ACCOUNT="vscodeweb" \
       AZURE_TENANT_ID="$(AZURE_TENANT_ID)" \
       AZURE_CLIENT_ID="$(AZURE_CLIENT_ID)" \
-      AZURE_CLIENT_SECRET="$(AZURE_CLIENT_SECRET)" \
+      AZURE_ID_TOKEN="$(AZURE_ID_TOKEN)" \
         node build/azure-pipelines/upload-sourcemaps out-vscode-web-min out-vscode-web-min/vs/workbench/workbench.web.main.js.map
     displayName: Upload sourcemaps (Web Main)
 
@@ -145,7 +145,7 @@ steps:
       AZURE_STORAGE_ACCOUNT="vscodeweb" \
       AZURE_TENANT_ID="$(AZURE_TENANT_ID)" \
       AZURE_CLIENT_ID="$(AZURE_CLIENT_ID)" \
-      AZURE_CLIENT_SECRET="$(AZURE_CLIENT_SECRET)" \
+      AZURE_ID_TOKEN="$(AZURE_ID_TOKEN)" \
         node build/azure-pipelines/upload-sourcemaps out-vscode-web-min out-vscode-web-min/vs/workbench/workbench.web.main.internal.js.map
     displayName: Upload sourcemaps (Web Internal)
 
@@ -157,7 +157,7 @@ steps:
       AZURE_STORAGE_ACCOUNT="ticino" \
       AZURE_TENANT_ID="$(AZURE_TENANT_ID)" \
       AZURE_CLIENT_ID="$(AZURE_CLIENT_ID)" \
-      AZURE_CLIENT_SECRET="$(AZURE_CLIENT_SECRET)" \
+      AZURE_ID_TOKEN="$(AZURE_ID_TOKEN)" \
         node build/azure-pipelines/upload-sourcemaps out-vscode-web-min out-vscode-web-min/vs/workbench/workbench.web.main.js.map
     displayName: Upload sourcemaps (Deprecated)
 
@@ -166,7 +166,7 @@ steps:
       AZURE_STORAGE_ACCOUNT="vscodeweb" \
       AZURE_TENANT_ID="$(AZURE_TENANT_ID)" \
       AZURE_CLIENT_ID="$(AZURE_CLIENT_ID)" \
-      AZURE_CLIENT_SECRET="$(AZURE_CLIENT_SECRET)" \
+      AZURE_ID_TOKEN="$(AZURE_ID_TOKEN)" \
         node build/azure-pipelines/upload-nlsmetadata
     displayName: Upload NLS Metadata