[rush-azure-storage-build-cache-plugin] Add support for auth via AzurePipelinesCredential

common/changes/@microsoft/rush/azure-pipeline-credential_2024-08-07-00-13.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add AzurePipelinesCredential support to rush azure storage build cache",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}

common/config/subspaces/default/repo-state.json

@@ -1,5 +1,5 @@
 // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush.
 {
-  "pnpmShrinkwrapHash": "b57605a120edc7c8740eb54e092f24d026f7819f",
+  "pnpmShrinkwrapHash": "37b11d6b25526493014e83332b2e15fe9d177f24",
   "preferredVersionsHash": "ce857ea0536b894ec8f346aaea08cfd85a5af648"
 }

rush-plugins/rush-azure-storage-build-cache-plugin/package.json

@@ -18,7 +18,7 @@
     "_phase:test": "heft run --only test -- --clean"
   },
   "dependencies": {
-    "@azure/identity": "~4.2.1",
+    "@azure/identity": "~4.4.1",
     "@azure/storage-blob": "~12.17.0",
     "@rushstack/node-core-library": "workspace:*",
     "@rushstack/rush-sdk": "workspace:*",

rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureAuthenticationBase.ts

@@ -2,6 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import {
+  AzurePipelinesCredential,
   DeviceCodeCredential,
   type DeviceCodeInfo,
   AzureAuthorityHosts,
@@ -80,7 +81,7 @@ export type AzureEnvironmentName = keyof typeof AzureAuthorityHosts;
 /**
  * @public
  */
-export type LoginFlowType = 'DeviceCode' | 'InteractiveBrowser' | 'AdoCodespacesAuth';
+export type LoginFlowType = 'DeviceCode' | 'InteractiveBrowser' | 'AdoCodespacesAuth' | 'AzurePipelines';
 
 /**
  * @public
@@ -150,6 +151,7 @@ export abstract class AzureAuthenticationBase {
     this._credentialUpdateCommandForLogging = options.credentialUpdateCommandForLogging;
     this._loginFlow = options.loginFlow || 'DeviceCode';
     this._failoverOrder = options.loginFlowFailover || {
+      AzurePipelines: 'AdoCodespacesAuth',
       AdoCodespacesAuth: 'InteractiveBrowser',
       InteractiveBrowser: 'DeviceCode',
       DeviceCode: undefined
@@ -300,6 +302,28 @@ export abstract class AzureAuthenticationBase {
         tokenCredential = new AdoCodespacesAuthCredential();
         break;
       }
+      case 'AzurePipelines': {
+        const systemAccessToken = process.env.SYSTEM_ACCESSTOKEN;
+        // If we have a system access token, we are in Azure Pipelines
+        if (systemAccessToken) {
+          const serviceConnectionID = process.env.AZURESUBSCRIPTION_SERVICE_CONNECTION_ID;
+          const clientID = process.env.AZURESUBSCRIPTION_CLIENT_ID;
+          const tenantID = process.env.AZURESUBSCRIPTION_TENANT_ID;
+          if (serviceConnectionID && clientID && tenantID) {
+            tokenCredential = new AzurePipelinesCredential(
+              tenantID,
+              clientID,
+              serviceConnectionID,
+              systemAccessToken
+            );
+          } else {
+            throw new Error(
+              `Running in Azure Pipelines environment. Missing environment variables: serviceConnectionID: ${serviceConnectionID}, tenantID: ${tenantID}, clientID: ${clientID}`
+            );
+          }
+        }
+        throw new Error(`SYSTEM_ACCESSTOKEN is not set while attempting '${loginFlow}' login flow`);
+      }
       case 'InteractiveBrowser': {
         tokenCredential = new InteractiveBrowserCredential(interactiveCredentialOptions);
         break;