awesome-reviewers/_reviewers/azure-sdk-for-net-externalize-sensitive-credentials.json

[
  {
    "discussion_id": "2109943039",
    "pr_number": 50282,
    "pr_file": "eng/common/pipelines/templates/jobs/npm-publish.yml",
    "created_at": "2025-05-27T18:55:49+00:00",
    "commented_code": "parameters:\n  Tag: 'latest'\n  ArtifactName: 'packages'\n  DependsOn: []\n  Environment: 'package-publish'\n  Registry: 'https://registry.npmjs.org/'\n\njobs:\n- deployment: PublishPackage_${{ parameters.ArtifactName }}\n  displayName: 'Publish ${{ parameters.ArtifactName }} to ${{ parameters.Registry }}'  \n  environment: ${{ parameters.Environment }}\n  dependsOn: ${{ parameters.DependsOn }}\n  variables:\n    - name: ArtifactPath\n      value: $(Pipeline.Workspace)/${{ parameters.ArtifactName }}\n\n  templateContext:\n    type: releaseJob\n    isProduction: ${{ eq(parameters.Registry, 'https://registry.npmjs.org/') }}\n    inputs:\n    - input: pipelineArtifact\n      artifactName: ${{ parameters.ArtifactName }}\n      itemPattern: '**/*.tgz'\n      targetPath: $(ArtifactPath)\n\n  pool:\n    name: azsdk-pool\n    image: ubuntu-24.04\n    os: linux\n  \n  strategy:\n    runOnce:\n      deploy:\n        steps:\n        - pwsh: |\n            foreach ($package in (dir $(ArtifactPath) *.tgz -Recurse)) {\n              Write-Host \"Publishing $package to ${{ parameters.Registry }} with tag ${{ parameters.Tag }}\"\n            }\n          displayName: 'Display packages to be published'\n\n        - ${{ if eq(parameters.Registry, 'https://registry.npmjs.org/') }}:\n          - task: EsrpRelease@9\n            displayName: 'Publish ${{ parameters.ArtifactName }} via ESRP'\n            inputs:\n              ConnectedServiceName: 'Azure SDK PME Managed Identity'\n              ClientId: '5f81938c-2544-4f1f-9251-dd9de5b8a81b'",
    "repo_full_name": "Azure/azure-sdk-for-net",
    "discussion_comments": [
      {
        "comment_id": "2109943039",
        "repo_full_name": "Azure/azure-sdk-for-net",
        "pr_number": 50282,
        "pr_file": "eng/common/pipelines/templates/jobs/npm-publish.yml",
        "discussion_id": "2109943039",
        "commented_code": "@@ -0,0 +1,73 @@\n+parameters:\n+  Tag: 'latest'\n+  ArtifactName: 'packages'\n+  DependsOn: []\n+  Environment: 'package-publish'\n+  Registry: 'https://registry.npmjs.org/'\n+\n+jobs:\n+- deployment: PublishPackage_${{ parameters.ArtifactName }}\n+  displayName: 'Publish ${{ parameters.ArtifactName }} to ${{ parameters.Registry }}'  \n+  environment: ${{ parameters.Environment }}\n+  dependsOn: ${{ parameters.DependsOn }}\n+  variables:\n+    - name: ArtifactPath\n+      value: $(Pipeline.Workspace)/${{ parameters.ArtifactName }}\n+\n+  templateContext:\n+    type: releaseJob\n+    isProduction: ${{ eq(parameters.Registry, 'https://registry.npmjs.org/') }}\n+    inputs:\n+    - input: pipelineArtifact\n+      artifactName: ${{ parameters.ArtifactName }}\n+      itemPattern: '**/*.tgz'\n+      targetPath: $(ArtifactPath)\n+\n+  pool:\n+    name: azsdk-pool\n+    image: ubuntu-24.04\n+    os: linux\n+  \n+  strategy:\n+    runOnce:\n+      deploy:\n+        steps:\n+        - pwsh: |\n+            foreach ($package in (dir $(ArtifactPath) *.tgz -Recurse)) {\n+              Write-Host \"Publishing $package to ${{ parameters.Registry }} with tag ${{ parameters.Tag }}\"\n+            }\n+          displayName: 'Display packages to be published'\n+\n+        - ${{ if eq(parameters.Registry, 'https://registry.npmjs.org/') }}:\n+          - task: EsrpRelease@9\n+            displayName: 'Publish ${{ parameters.ArtifactName }} via ESRP'\n+            inputs:\n+              ConnectedServiceName: 'Azure SDK PME Managed Identity'\n+              ClientId: '5f81938c-2544-4f1f-9251-dd9de5b8a81b'",
        "comment_created_at": "2025-05-27T18:55:49+00:00",
        "comment_author": "Copilot",
        "comment_body": "Ensure that client identifiers and similar sensitive configuration values are managed securely, for example via secret variable groups, rather than being hard-coded in the pipeline file.\n```suggestion\n              ClientId: $(ClientId)\n```",
        "pr_file_module": null
      }
    ]
  }
]