[release/10.0] Backport refreshable Helix Entra authentication

[missymessa]

Summary

Backports refreshable Helix Entra authentication to release/10.0 for AB#12269:

• Add Entra authentication to the Helix API client #17366: Helix API client Entra authentication foundation
• [12269] Test Helix Entra token refresh #17510: token refresh coverage
• Integrate refreshable Helix Entra auth with SDK tasks #17537: SDK tasks, JobMonitor, and pipeline template integration

The backport also targets Microsoft.DotNet.ArcadeAzureIntegration for $(NetMinimum) so the release/10.0 net8.0 JobMonitor can consume the shared credential implementation without raising its runtime requirement.

Validation

• dotnet test src\Microsoft.DotNet.Helix\Sdk.Tests\Microsoft.DotNet.Helix.Sdk.Tests\Microsoft.DotNet.Helix.Sdk.Tests.csproj --configuration Release --nologo --no-restore
• Passed: 311, Failed: 0, Skipped: 0
• The targeted project build includes Microsoft.DotNet.Helix.JobMonitor (net8.0).

[Copilot]

🟡 Changes recommended

Critical compatibility findings show the SDK cannot compile for its net472/net481 targets because DefaultIdentityTokenCredential is unavailable there; add the required guards or framework stub.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Backports refreshable Entra authentication across Helix SDK tasks, API clients, Job Monitor, and Azure Pipelines while retaining existing authentication modes.

Changes:

• Adds scoped, expiry-aware Entra authentication and refresh.
• Propagates settings through SDK targets, Job Monitor, and pipeline templates.
• Adds tests, documentation, and .NET 8 integration support.

File summaries

File	Change
src/Microsoft.DotNet.Helix/Sdk/tools/Microsoft.DotNet.Helix.Sdk.props	Defines authentication defaults.
src/Microsoft.DotNet.Helix/Sdk/tools/Microsoft.DotNet.Helix.Sdk.MultiQueue.targets	Propagates authentication settings.
src/Microsoft.DotNet.Helix/Sdk/tools/Microsoft.DotNet.Helix.Sdk.MonoQueue.targets	Propagates authentication settings.
src/Microsoft.DotNet.Helix/Sdk/tools/download-results/DownloadFromResultsContainer.targets	Passes authentication to result downloads.
src/Microsoft.DotNet.Helix/Sdk/SendHelixJob.cs	Updates authentication validation.
src/Microsoft.DotNet.Helix/Sdk/Readme.md	Documents Entra configuration.
src/Microsoft.DotNet.Helix/Sdk/Microsoft.DotNet.Helix.Sdk.csproj	Adds Azure integration reference.
src/Microsoft.DotNet.Helix/Sdk/HelixTask.cs	Selects PAT, anonymous, or Entra clients.
src/Microsoft.DotNet.Helix/Sdk/GetHelixWorkItems.cs	Preserves PAT file-link behavior.
src/Microsoft.DotNet.Helix/Sdk/CancelHelixJob.cs	Supports authenticated cancellation.
src/Microsoft.DotNet.Helix/Sdk.Tests/Microsoft.DotNet.Helix.Sdk.Tests/QueueStatsLoggingTests.cs	Tests creator validation.
src/Microsoft.DotNet.Helix/Sdk.Tests/Microsoft.DotNet.Helix.Sdk.Tests/Microsoft.DotNet.Helix.Sdk.Tests.csproj	Adds client project references.
src/Microsoft.DotNet.Helix/Sdk.Tests/Microsoft.DotNet.Helix.Sdk.Tests/HelixApiAuthenticationTests.cs	Tests authentication and refresh behavior.
src/Microsoft.DotNet.Helix/JobMonitor/Microsoft.DotNet.Helix.JobMonitor.csproj	Adds Azure integration reference.
src/Microsoft.DotNet.Helix/JobMonitor/JobMonitorRunner.cs	Selects and configures Entra authentication.
src/Microsoft.DotNet.Helix/JobMonitor/JobMonitorOptions.cs	Adds CLI and environment configuration.
src/Microsoft.DotNet.Helix/Client/CSharp/HelixApiOptions.cs	Adds authentication modes, scopes, and bearer policy.
src/Microsoft.DotNet.Helix/Client/CSharp/ApiFactory.cs	Adds Entra client factories.
src/Microsoft.DotNet.ArcadeAzureIntegration/Microsoft.DotNet.ArcadeAzureIntegration.csproj	Adds the .NET 8 target.
eng/common/core-templates/steps/send-to-helix.yml	Configures pipeline Entra authentication.
eng/common/core-templates/job/job.yml	Clarifies token-variable behavior.
eng/common/core-templates/job/helix-job-monitor.yml	Adds monitor Entra configuration.
Documentation/AzureDevOps/SendingJobsToHelix.md	Documents pipeline authentication options.

Review details

• Files reviewed: 23/23 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Two unresolved critical issues affect job submission and bearer-token transport security.

Get a fresh assessment by requesting another Copilot review.

Review details

• Files reviewed: 23/23 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

Custom HTTPS Helix base URI handling remains unresolved for Entra authentication in JobMonitor and HelixTask.

Review details

Suppressed comments (2)

src/Microsoft.DotNet.Helix/JobMonitor/JobMonitorRunner.cs:825

• The standalone monitor exposes helixBaseUri, and PAT authentication accepts arbitrary base URIs, but the Entra path always selects default scope discovery here. For a custom HTTPS Helix host, HelixApiOptions throws because no default scope is known; expose an explicit Entra scope through JobMonitorOptions/the template or document and enforce the supported hosts.

        return ApiFactory.GetAuthenticatedWithEntra(
            baseUri,
            new DefaultIdentityTokenCredential());

src/Microsoft.DotNet.Helix/Sdk/HelixTask.cs:103

• With Entra enabled, a custom HTTPS BaseUri reaches this overload, which only has default scopes for helix.dot.net and helix.int-dot.net and otherwise throws before making a request. ApiFactory exposes an explicit-scope overload for custom Helix instances, but HelixTask has no scope input, so this new auth mode breaks the existing BaseUri customization; thread the scope through the task/template or explicitly constrain the supported hosts.

        return ApiFactory.GetAuthenticatedWithEntra(
            baseUri,
            new DefaultIdentityTokenCredential());

• Files reviewed: 25/25 changed files
• Comments generated: 0 new
• Review effort level: Lite

[missymessa]

Addressed the latest Copilot review's suppressed custom-host findings in ee37b23. Both submission tasks and JobMonitor now accept an optional explicit Entra scope (HelixEntraScope / helixEntraScope) for custom HTTPS Helix base URIs, while production and staging retain inferred scopes. The scope is propagated through all SDK tasks, result downloads, and both pipeline templates.

Validation:

• Debug and Release Microsoft.DotNet.Helix.Sdk builds: net10.0 + net472, 0 warnings/errors
• Release Microsoft.DotNet.Helix.JobMonitor build: net8.0, 0 warnings/errors
• Microsoft.DotNet.Helix.Sdk.Tests: 314/314 passed, including custom-host scope coverage for both SDK tasks and JobMonitor

[Copilot]

🟡 Changes recommended

The default-host download regression and public authentication-path compatibility issue remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

src/Microsoft.DotNet.Helix/Client/CSharp/HelixApiOptions.cs:70

• This changes the existing public HelixApiOptions(Uri, TokenCredential) path for every credential that is not HelixApiTokenCredential: it used to go through HelixApiTokenAuthenticationPolicy with empty scopes, but now every such credential is treated as Entra and gets a host-derived scope. Consumers that supplied their own TokenCredential for the legacy policy can therefore fail on custom/HTTP hosts or receive a different authorization scheme; preserve the old overload semantics and expose Entra through a distinct constructor/factory, or document this as a breaking API change.

        else
        {
            AuthenticationMode = HelixApiAuthenticationMode.EntraId;
            if (TokenScopes.Count == 0)
            {

• Files reviewed: 25/25 changed files
• Comments generated: 1
• Review effort level: Lite

[missymessa]

Addressed the suppressed public-constructor compatibility finding in aa6ddf6. Existing HelixApiOptions(TokenCredential) and HelixApiOptions(Uri, TokenCredential) callers now retain the legacy token authorization policy with empty scopes, including custom/HTTP hosts. Entra factories now opt into the explicit-scopes constructor, so Bearer authentication, host-derived scopes, refresh behavior, and HTTPS validation remain on the Entra-specific paths. Regression coverage exercises both legacy constructors, custom hosts, token versus Bearer headers, and production/staging scope inference. The full Helix SDK suite passes (319 tests).

[Copilot]

🔵 Needs a closer look

The changes span authentication, SDK tasks, JobMonitor, pipelines, framework targeting, and documentation.

Review details

• Files reviewed: 25/25 changed files
• Comments generated: 0 new
• Review effort level: Lite