Add Microsoft Managed Apps host provider - #2406
Draft
alanc-msft wants to merge 27 commits into
Draft
Conversation
Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.2.0 to 5.3.0. - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@v5.2.0...v5.3.0) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
According to actions/setup-dotnet#739, this is required if we want to upgrade to `actions/setup-dotnet@5.3.0`. Suggested by Marc Becker. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
The authorization code flow only handled the default 'query' response mode, where the loopback browser reads the response from the request query string and returns a URI for the client to parse. The 'fragment' and 'form_post' modes deliver the response over channels a URI cannot represent - the fragment is never transmitted to the server, and form_post arrives as a urlencoded POST body - so hosts that mandate those modes could not be used. Have the browser return the parsed response parameters regardless of transport and tell it which mode to expect. The system browser reads the POST body for form_post, and for fragment serves a small page that re-submits the parameters as a form POST to the loopback redirect - keeping the authorization code out of the URL, browser history, and server logs. The client sends 'response_mode' only when it is not the default, so existing query-mode requests are unchanged. Assisted-by: Claude Opus 4.8 Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Now that the OAuth client can request non-query response modes, expose the choice to generic host configurations through a new optional setting (credential.<host>.oauthResponseMode, or the GCM_OAUTH_RESPONSE_MODE environment variable). The built-in providers target known hosts that use 'query', so the generic provider is the only place an arbitrary host's response mode needs to be configurable. The setting is optional and defaults to 'query', so existing configurations are unaffected. An unrecognised value is traced and falls back to the default rather than failing configuration outright. Assisted-by: Claude Opus 4.8 Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Update our MSAL library packages to the current latest release, which is 4.82.2 at time of writing. Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
The "auto" Microsoft authentication flow type was resolved lazily, deep inside the interactive-token switch via `goto case`, after the MSAL public client application — and thus its redirect URI — had already been built. That entangled flow selection with app creation and made the effective flow hard to follow in traces. Resolve the flow up front in GetFlowType() instead, and drop the Auto pseudo-value from the enum so the method always returns a concrete flow (embedded web view, system web view, or device code). The resolved flow is traced before authentication starts. Knowing the flow up front also lets us choose the redirect URI. Only the system web view needs a real loopback redirect URI registered with the application; the other paths work with MSAL's default native-client redirect URI — "https://login.microsoftonline.com/common/oauth2/nativeclient" on .NET Framework, "http://localhost" on .NET Core. Forward the caller-provided redirect URI only when the system web view might be used and let MSAL supply the default otherwise via WithDefaultRedirectUri(). The Microsoft authentication diagnostic no longer calls GetFlowType() (which now needs a redirect URI and eagerly resolves auto); it reports the raw credential.msAuthFlow override instead. The now-unused IPublicClientApplication argument is dropped from the system web view capability checks. Assisted-by: Claude Opus 4.8 Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
…stem#2352) Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.2.0 to 5.3.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-dotnet/releases">actions/setup-dotnet's releases</a>.</em></p> <blockquote> <h2>v5.3.0</h2> <h2>What's Changed</h2> <h3>Enhancements</h3> <ul> <li>Add dotnet-version: latest support with dotnet-channel input by <a href="https://github.com/mahabaleshwars"><code>@mahabaleshwars</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/730">actions/setup-dotnet#730</a></li> <li>Support global.json's rollForward latest* variants by <a href="https://github.com/js6pak"><code>@js6pak</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/538">actions/setup-dotnet#538</a></li> <li>Improve version resolution by <a href="https://github.com/akoeplinger"><code>@akoeplinger</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/560">actions/setup-dotnet#560</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Upgrade @actions/* and fast-xml-parser dependencies by <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/728">actions/setup-dotnet#728</a></li> <li>Update install scripts to v2026.05.19 (preserve archive links) by <a href="https://github.com/MichaelSimons"><code>@MichaelSimons</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/736">actions/setup-dotnet#736</a></li> <li>Add rollForward note in README, improve proxy health check in e2e tests and bump version to v5.3.0 by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/738">actions/setup-dotnet#738</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>Update Test Proxy job by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/703">actions/setup-dotnet#703</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/728">actions/setup-dotnet#728</a></li> <li><a href="https://github.com/akoeplinger"><code>@akoeplinger</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/560">actions/setup-dotnet#560</a></li> <li><a href="https://github.com/MichaelSimons"><code>@MichaelSimons</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/736">actions/setup-dotnet#736</a></li> <li><a href="https://github.com/js6pak"><code>@js6pak</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/538">actions/setup-dotnet#538</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-dotnet/compare/v5...v5.3.0">https://github.com/actions/setup-dotnet/compare/v5...v5.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-dotnet/commit/9a946fdbd5fb07b82b2f5a4466058b876ab72bb2"><code>9a946fd</code></a> Add rollForward note in README, improve proxy health check in e2e tests and b...</li> <li><a href="https://github.com/actions/setup-dotnet/commit/98af08bf649b02f9e94783278906d34780362f6f"><code>98af08b</code></a> Support global.json's rollForward latest* variants (<a href="https://redirect.github.com/actions/setup-dotnet/issues/538">#538</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/84042723628274fd730a70726fbf57ef89e586de"><code>8404272</code></a> Update install scripts to v2026.05.19 (<a href="https://redirect.github.com/actions/setup-dotnet/issues/736">#736</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/f1970f5ca30a3ba974274132e05c4bb012faac74"><code>f1970f5</code></a> Don't download releases-index.json to resolve major version (<a href="https://redirect.github.com/actions/setup-dotnet/issues/560">#560</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/af9211b1364d382bc386cd82c6386875ad2ad796"><code>af9211b</code></a> Add dotnet-version: latest support with dotnet-channel input (<a href="https://redirect.github.com/actions/setup-dotnet/issues/730">#730</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/df991aeaf2a76aae144b0b70ce23e455c66f061e"><code>df991ae</code></a> chore: bump @actions/* and fast-xml-parser dependencies (<a href="https://redirect.github.com/actions/setup-dotnet/issues/728">#728</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/a66eefa2bf2572fc311ea6ff65a7b6ecc4df96a6"><code>a66eefa</code></a> CI: remove manual PowerShell install from test-proxy job (e2e-tests.yml) (<a href="https://redirect.github.com/actions/setup-dotnet/issues/703">#703</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-dotnet/compare/v5.2.0...v5.3.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> <h2>v6.0.2</h2> <h2>What's Changed</h2> <ul> <li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> <li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/v6...v7">compare view</a></li> </ul> </details> <br />
msal: update to latest MSAL 4.82.2
msauth: resolve auth flow before selecting redirect URI
Support non-query OAuth response modes (`fragment`, `form_post`)
Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.3.0 to 5.4.0. - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@v5.3.0...v5.4.0) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: 5.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…stem#2361) Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.3.0 to 5.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-dotnet/releases">actions/setup-dotnet's releases</a>.</em></p> <blockquote> <h2>v5.4.0</h2> <h2>What's Changed</h2> <h3>Enhancements</h3> <ul> <li>Improve global.json SDK version validation for rollForward by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/742">actions/setup-dotnet#742</a></li> <li>Pin actions to commit SHAs in workflows by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/744">actions/setup-dotnet#744</a></li> <li>Expand the CSC problem matcher to light up more errors on GitHub. by <a href="https://github.com/StephenCleary"><code>@StephenCleary</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/717">actions/setup-dotnet#717</a></li> </ul> <h3>Documentation</h3> <ul> <li>Docs(action): Explicitly mark all optional inputs with required: false by <a href="https://github.com/kranthipoturaju"><code>@kranthipoturaju</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/737">actions/setup-dotnet#737</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>Fix global.json creation command by <a href="https://github.com/michal2612"><code>@michal2612</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/694">actions/setup-dotnet#694</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/746">actions/setup-dotnet#746</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/746">actions/setup-dotnet#746</a></li> <li><a href="https://github.com/michal2612"><code>@michal2612</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/694">actions/setup-dotnet#694</a></li> <li><a href="https://github.com/kranthipoturaju"><code>@kranthipoturaju</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/737">actions/setup-dotnet#737</a></li> <li><a href="https://github.com/StephenCleary"><code>@StephenCleary</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/717">actions/setup-dotnet#717</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-dotnet/compare/v5...v5.4.0">https://github.com/actions/setup-dotnet/compare/v5...v5.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-dotnet/commit/26b0ec14cb23fa6904739307f278c14f94c95bf1"><code>26b0ec1</code></a> Expand the CSC problem matcher to light up more errors on GitHub. (<a href="https://redirect.github.com/actions/setup-dotnet/issues/717">#717</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/da5e5482f2d0700168cff080da45b50da8b60f0e"><code>da5e548</code></a> docs(action): explicitly mark all optional inputs with required: false (<a href="https://redirect.github.com/actions/setup-dotnet/issues/737">#737</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/9bd3b44355ba7c500f3d2e029636c6d29ac5caab"><code>9bd3b44</code></a> Improve readability of global.json creation command (<a href="https://redirect.github.com/actions/setup-dotnet/issues/694">#694</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/4406a635cd2be9c92689ea22b2f74ea57297088c"><code>4406a63</code></a> Bump <code>@actions/cache</code> to 5.1.0, log cache write denied (<a href="https://redirect.github.com/actions/setup-dotnet/issues/746">#746</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/dc3262dda80e97f1c7865b3b122e99240e30b738"><code>dc3262d</code></a> pin actions to commit SHAs in workflows (<a href="https://redirect.github.com/actions/setup-dotnet/issues/744">#744</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/95a3f8b067437dc9b2027a437f5dc3b4569ddd49"><code>95a3f8b</code></a> Validate global.json SDK version before rollForward optimization (<a href="https://redirect.github.com/actions/setup-dotnet/issues/742">#742</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-dotnet/compare/v5.3.0...v5.4.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
The link to the Windows Credential Manager docs was broken - it used to point at: https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0 ..but this now resolves instead to: https://support.microsoft.com/en-US/Windows/Security/credential-manager-in-windows ..so let's use that URL directly. Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
The link to the Windows Credential Manager docs was broken - it used to point at: https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0 ..but this now resolves instead to: https://support.microsoft.com/en-US/Windows/Security/credential-manager-in-windows ..so let's use that URL directly.
We have been using an inappropriate key for our Debian package signing; let's use a more appropriate one. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
GCM launches the system browser for interactive OAuth by handing the authorization URL to the OS "shell execute" handler. On macOS that is /usr/bin/open, which validates the URL and, on finding any character that is not legal in a fully percent-encoded URL, re-encodes the whole query string. That step double-escapes parameters we had already encoded -- redirect_uri=http%3A%2F%2F... becomes redirect_uri=http%253A%252F%252F... -- and the authorization server rejects the redirect. Windows ShellExecuteEx forwards the string verbatim, so only macOS is affected. The trigger was a raw space in the query. Uri.ToString() is a display form that unescapes %20 back to a literal space (while leaving %2F alone), so building the launch string that way reintroduced spaces, most easily via the space-delimited scope parameter. This surfaced after MSAL began encoding spaces[1] as %20 rather than +; a literal + is left untouched by ToString(), which had masked the problem. Uri.AbsoluteUri keeps the query fully percent-encoded, so %20 stays %20 and macOS open accepts the URL unchanged. [1]: AzureAD/microsoft-authentication-library-for-dotnet#5128 Assisted-by: Claude Opus 4.8 Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
With the ESRP-signed packages, there is a slightly different process. Most notably, the PGP key to verify against has changed and needs to be obtained from elsewhere. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Most users will want to stick to Debian packages. Those who have to resort to the archive will want to download them from the correct location. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
With ESRP-based signing applied even to the Debian packages, we need to use the correct PGP key. This PR is a companion of microsoft/git#946.
browser: open AbsoluteUri to avoid double-escaping
Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Explicitly use Central Feed Services (CFS) feeds for NuGet packages by replacing the normal, nuget.org, config file in the repo root at the start of the build jobs. This is required for compliance, and the auto-injected task that is supposed to do this automatically is flakey (it doesn't run sometimes?!) so do this manually. Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Adds a new GCM host provider, Microsoft.ManagedApps, that automatically authenticates against Git repositories hosted by Microsoft Managed Apps' Power Platform environment Git service, removing the need for users to hand-author a per-environment [credential "https://<host>"] generic OAuth configuration block for every environment they clone from. - Host recognition (ManagedAppsCloudEnvironment): matches hosts against a suffix table per deployment "cloud environment" (prod today; preprod, test, and future sovereign clouds are addable as single compiled-in table entries once their resource/scopes are confirmed). A cloud environment only participates in matching once it has a complete definition (host suffix + resource + scopes), so unconfigured hosts safely fall through to the existing generic OAuth provider with zero regression risk. - Authentication: reuses the existing, shared MicrosoftAuthentication (MSAL-based) component, the same one Microsoft.AzureRepos uses, instead of the generic OAuth provider's per-host OAuth2 client. Because MSAL's token cache is keyed by client/authority/account rather than hostname, a single interactive sign-in is silently reused across every Managed Apps environment. - Non-interactive auth: supports managed identity, service principal, and workload identity federation for CI/CD, mirroring Microsoft.AzureRepos. - Extensibility: new cloud environments are a single-entry addition to a compiled-in table, or addable purely via Git configuration (credential.managedAppsCloudEnvironment.<name>.*) ahead of an official release. Known open item: prod's scopes currently use the broad https://api.powerplatform.com/.default grant rather than the originally intended granular GitRepositories.* permissions, which Microsoft Entra ID rejected with AADSTS65002 (first-party preauthorization required). Reverting once that is granted is a one-line change (see the comment in ManagedAppsCloudEnvironment.CompiledInDefaults). Adds Microsoft.ManagedApps.Tests with unit coverage for host matching, config-merge behavior, all four credential-generation paths, and the account-binding manager. Registered at Normal priority alongside AzureRepos/Bitbucket/GitHub/GitLab, before the generic catch-all provider. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a new GCM host provider,
Microsoft.ManagedApps, that automatically authenticates against Git repositories hosted by Microsoft Managed Apps' Power Platform environment Git service.Today, users must hand-author a
[credential "https://<host>"]generic OAuth configuration block for every environment subdomain they clone from (each environment gets its own opaque, per-instance hostname). This does not scale, is error-prone, and does not provide single sign-on across environments (the generic OAuth provider keys its refresh-token cache per-hostname).This PR is a draft shared for early design feedback before further polishing/upstreaming — see "Open items" below.
Design
ManagedAppsCloudEnvironment): matches hosts against a suffix table per deployment "cloud environment" (prodtoday;preprod,test, and future sovereign clouds are addable as single compiled-in table entries once their resource/scopes are confirmed). A cloud environment only participates in matching once it has a complete definition (host suffix + resource + scopes), so unconfigured hosts safely fall through to the existing generic OAuth provider with zero regression risk.MicrosoftAuthentication(MSAL-based) component — the same oneMicrosoft.AzureReposuses — instead of the generic OAuth provider's per-host OAuth2 client. Because MSAL's token cache is keyed by client/authority/account rather than hostname, a single interactive sign-in is silently reused across every Managed Apps environment.Microsoft.AzureRepos.credential.managedAppsCloudEnvironment.<name>.*) ahead of an official release.Normalpriority alongside AzureRepos/Bitbucket/GitHub/GitLab, before the generic catch-all provider.Testing
Microsoft.ManagedApps.Testsproject: unit coverage for host matching, config-merge behavior, all four credential-generation paths, and the account-binding manager.dotnet build -c WindowsDebuganddotnet testboth pass locally (923/923 tests, including the 50 new ones).Open items
prod's scopes currently use the broaderhttps://api.powerplatform.com/.defaultgrant rather than the originally intended granularGitRepositories.*permissions, which Microsoft Entra ID rejected withAADSTS65002(first-party preauthorization required). Reverting once that's granted is a one-line change (see the comment inManagedAppsCloudEnvironment.CompiledInDefaults).preprod/test/sovereign-cloud resource+scopes are not yet defined by the service; those cloud environments are recognized by host suffix only and remain unmatched (safe fallback) until completed.Id,Name, namespace) are open to feedback.Opened as a draft for early feedback — not requesting review/merge yet.