Automatically install the Azure Artifacts Credential Provider if DevOps NuGet feeds are configured

[rhyskoedijk]

What are you trying to accomplish?

Allow users to authenticate with private Azure DevOps NuGet feeds without any additional configuration or complicated workarounds. Ideally auth should "just work" like it did in v1.24.

Reduce the number of issues users are having with private NuGet feed auth. e.g. see comments in:

• nuget authentication issues from version 1.25 #921 (comment)
• Nuget automatic update failure #1201 (comment)
• Image for 1.24 is removed #1206 (comment)
• Error while generating commit message: Passed nil into T.must #1232 (comment)

Changes

If DEPENDABOT_EXTRA_CREDENTIALS contains credentials for an Azure DevOps NuGet feed, the workaround detailed in #921 (comment) will be applied-- more specifically, VSS_NUGET_EXTERNAL_FEED_ENDPOINTS will be set using the configured credentials, then the Azure Artifacts Credential Provider is installed to the container.

This automatically runs for both update_script.rb and update_script_vnext.rb.

This module can be easily deleted once dependabot/dependabot-core#8927 or some other dependabot-core native auth solution becomes available.

[rgrace-puck]

There is an existing task in Azure Pipelines that installs & configures NuGet authentication:
https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/nuget-authenticate-v1

Would it be possible to glean information from that automatically instead of requiring another environment variable to be set?

[rhyskoedijk]

There is an existing task in Azure Pipelines that installs & configures NuGet authentication: https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/nuget-authenticate-v1

Would it be possible to glean information from that automatically instead of requiring another environment variable to be set?

Unfortunately that task doesn't have any impact on the update process since Dependabot is run inside a Docker container which is isolated from the Azure pipeline. Any information configured or provided by that task cannot be accessed from within the Dependabot container instance.

With this change, the user does not need to set any additional environment variables; the script will use the auth provided in your dependabot.yml registries and pass it through to the Azure Artifacts Credential Provider so that NuGet and MSBuild have access to them.

[mburumaxwell]

This is good. Still, I think we'll never be able to solve permissions issues given the complex permissions in AzDO and its OnPrem server

[mburumaxwell]

In some cases it is only ":{PAT}" or ":{PAT}". I think we should check for colon then split and take second entry, otherwise take as is.

[rhyskoedijk]

Good point, I also didn't consider username/password auth either.
It should now support all of these configs:

• {"type":"nuget_feed","url":"https://dev.azure.com/...","token":"PAT:abc123"}
• {"type":"nuget_feed","url":"https://dev.azure.com/...","token":":abc123"}
• {"type":"nuget_feed","url":"https://dev.azure.com/...","token":"abc123"}
• {"type":"nuget_feed","url":"https://dev.azure.com/...","username":"joeblogs","password":"letmein"}