From 4a0e33994a05559346ff9011f0abd9b1cbe1297c Mon Sep 17 00:00:00 2001 From: Ian Clanton-Thuon Date: Tue, 15 Sep 2026 22:52:38 -0400 Subject: [PATCH] Author automated bump PRs as the Azure Pipelines GitHub App The bump pipeline checked out "self", whose persisted credentials authenticate as the "rushbot" user account, so the automated "Bump package versions" PRs were authored by a real user and therefore required a Microsoft CLA signature on every run. Check out a "microsoft/tsdoc" repository resource via the "GitHubProjects" Azure Pipelines GitHub App endpoint instead (mirroring the rushstack repo). The version-bump commit, branch push, PR creation, and build tag then run as the "azure-pipelines[bot]" identity, whose PRs are exempt from the CLA check. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d79bf579-32e9-40b3-91b0-98e008c81849 --- common/config/azure-pipelines/npm-publish.yaml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/common/config/azure-pipelines/npm-publish.yaml b/common/config/azure-pipelines/npm-publish.yaml index 62c30996..505eacd8 100644 --- a/common/config/azure-pipelines/npm-publish.yaml +++ b/common/config/azure-pipelines/npm-publish.yaml @@ -31,6 +31,16 @@ variables: resources: repositories: + # Checked out (with persisted credentials) so that the version-bump commit, branch push, PR, and + # build tag are all performed as the Azure Pipelines GitHub App identity ("azure-pipelines[bot]") + # rather than the "rushbot" user account. Bot-authored PRs are exempt from the Microsoft CLA + # check, whereas user-authored PRs (what "checkout: self" produced) require a CLA signature. This + # mirrors the rushstack repo, which checks out via the same "GitHubProjects" GitHub App endpoint. + - repository: tsdocGitHubApp + type: github + name: microsoft/tsdoc + endpoint: GitHubProjects + ref: refs/heads/main - repository: RushstackMainRepo type: github name: Microsoft/rushstack @@ -72,7 +82,7 @@ extends: targetPath: $(Build.ArtifactStagingDirectory)/json-schemas artifactName: json-schemas steps: - - checkout: self + - checkout: tsdocGitHubApp persistCredentials: true path: tsdoc