[release/9.0] Backport refreshable Helix Entra authentication

[missymessa]

Summary

Backports refreshable Helix Entra authentication to release/9.0 for AB#12269:

• Add Entra authentication to the Helix API client #17366: adds the TokenCredential-based Helix client foundation and production/staging scopes.
• [12269] Test Helix Entra token refresh #17510: adds coverage proving expired Entra tokens are reacquired.
• Integrate refreshable Helix Entra auth with SDK tasks #17537: applies the relevant SDK tasks, MSBuild targets, and send-to-helix.yml Azure service-connection integration.

For release/9.0, the Helix SDK uses the branch's existing Azure.Identity dependency rather than importing the main-only Microsoft.DotNet.ArcadeAzureIntegration project. It constructs AzurePipelinesCredential directly when the service-connection/OIDC environment is available, matching the proven Arcade credential-selection pattern, and otherwise falls back to DefaultAzureCredential for managed identity and local Azure CLI scenarios. Source-build remains explicitly unsupported for Entra authentication.

Release-specific omissions

The release/9.0 branch does not contain the main-era standalone JobMonitor project or template, so this intentionally omits:

• src/Microsoft.DotNet.Helix/JobMonitor/*
• eng/common/core-templates/job/helix-job-monitor.yml
• JobMonitor-only tests and documentation

No unused JobMonitor project or template was added.

Validation

• Helix SDK Release build (net472 and net9.0): succeeded with 0 warnings and 0 errors.
• Helix SDK test project Release build: succeeded with 0 warnings and 0 errors.
• HelixApiAuthenticationTests: 33 passed, 0 failed, 0 skipped.

[Copilot]

🟡 Changes recommended

The Azure service-connection login is not reliably available to the subsequent MSBuild process or consumable by DefaultAzureCredential.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Backports refreshable Entra authentication for the Helix SDK and Azure Pipelines on release/9.0.

Changes:

• Adds TokenCredential authentication, scopes, and refresh tests.
• Propagates Entra authentication through SDK tasks and client APIs.
• Integrates Azure service connections, source-build handling, and documentation.

File summaries

File	Summary
src/Microsoft.DotNet.Helix/Sdk/tools/Microsoft.DotNet.Helix.Sdk.props	Defines the authentication default.
src/Microsoft.DotNet.Helix/Sdk/tools/Microsoft.DotNet.Helix.Sdk.MultiQueue.targets	Propagates Entra settings to multi-queue tasks.
src/Microsoft.DotNet.Helix/Sdk/tools/Microsoft.DotNet.Helix.Sdk.MonoQueue.targets	Propagates Entra settings to job submission.
src/Microsoft.DotNet.Helix/Sdk/tools/download-results/DownloadFromResultsContainer.targets	Propagates authentication to downloads.
src/Microsoft.DotNet.Helix/Sdk/SendHelixJob.cs	Updates creator validation.
src/Microsoft.DotNet.Helix/Sdk/Readme.md	Documents authentication options.
src/Microsoft.DotNet.Helix/Sdk/Microsoft.DotNet.Helix.Sdk.csproj	Adds Azure Identity and source-build handling.
src/Microsoft.DotNet.Helix/Sdk/HelixTask.cs	Creates authenticated Helix clients.
src/Microsoft.DotNet.Helix/Sdk/GetHelixWorkItems.cs	Preserves PAT file-link behavior.
src/Microsoft.DotNet.Helix/Sdk/CancelHelixJob.cs	Supports Entra cancellation.
src/Microsoft.DotNet.Helix/Sdk.Tests/Microsoft.DotNet.Helix.Sdk.Tests/Microsoft.DotNet.Helix.Sdk.Tests.csproj	Adds client test references.
src/Microsoft.DotNet.Helix/Sdk.Tests/Microsoft.DotNet.Helix.Sdk.Tests/HelixApiAuthenticationTests.cs	Tests scopes, refresh, and task authentication.
src/Microsoft.DotNet.Helix/Client/CSharp/HelixApiOptions.cs	Adds authentication modes and scopes.
src/Microsoft.DotNet.Helix/Client/CSharp/ApiFactory.cs	Adds Entra client factories.
eng/common/core-templates/steps/send-to-helix.yml	Adds service-connection integration.
eng/common/core-templates/job/job.yml	Clarifies token handling.
Documentation/AzureDevOps/SendingJobsToHelix.md	Documents Entra usage.

Review details

• Files reviewed: 17/17 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Result downloads do not yet receive the configured Helix base URI, and Creator-validation coverage is incomplete.

Review details

Suppressed comments (2)

src/Microsoft.DotNet.Helix/Sdk/SendHelixJob.cs:170

• The new authentication decision also changes the Creator contract (anonymous requires it; PAT/Entra forbid it), but the added authentication tests do not exercise GetCreatorValidationError at all. Please add a theory covering anonymous, PAT, and Entra with both empty and populated Creator values so this boundary cannot regress silently.

            string creatorValidationError = GetCreatorValidationError(
                UseEntraAuthentication,
                AccessToken,
                Creator);

src/Microsoft.DotNet.Helix/Sdk/tools/download-results/DownloadFromResultsContainer.targets:29

• This task still uses HelixTask's default https://helix.dot.net/ because BaseUri is not passed here. When HelixBaseUri targets https://helix.int-dot.net, the job is sent to staging but this follow-up query goes to production and selects the wrong Entra scope, so result downloads fail. Pass the same base URI used by the other Helix tasks.

        UseEntraAuthentication="$(HelixUseEntraAuthentication)"

• Files reviewed: 17/17 changed files
• Comments generated: 0 new
• Review effort level: Lite