microsoft/Mint Azure DevOps feed token
Mint a short-lived Azure DevOps Artifacts feed bearer token on the runner (pure-Python, no Azure CLI, no uv) and expose it as step outputs: the masked token and a ready-to-use BuildKit `--secret` argument. The token is not written to the job environment, so it stays scoped to the steps that reference it.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| client-id | Azure AD (Entra) application/client ID of the federated identity. Defaults to the AZURE_CLIENT_ID environment variable. Required unless AZURE_CLIENT_ID is already set in the environment. | no | "" |
| tenant | Azure AD tenant ID. Defaults to the AZURE_TENANT_ID environment variable. | no | "" |
| resource | Resource ID to scope the token to. Defaults to the Azure DevOps resource used by the package. | no | "" |
Outputs
| name | description |
|---|---|
| token | The minted bearer token (also masked in logs). |
| secret-arg | A ready-to-use `docker buildx build` argument that forwards the token as a BuildKit secret: `--secret id=ARTIFACTS_KEYRING_NOFUSS_TOKEN,env=ARTIFACTS_KEYRING_NOFUSS_TOKEN`. Splice it into the build command and set ARTIFACTS_KEYRING_NOFUSS_TOKEN (from the `token` output) as a scoped `env:` on that build step. |