fix(server): Send Azure DevOps token via git extra headers (#23478) #23631

mikebordon · 2025-07-01T23:02:35Z

The project's "Git Askpass" implementation only supports username-password authentication, but Azure DevOps specifically requires the token be provided via an Authorization-Bearer request header. This change replaces the "store" approach required by the former in favor of the environment variable mechanism currently leveraged for HTTPS credentials when a bearer token is provided.

Fixes #23478

Checklist:

bunnyshell · 2025-07-01T23:02:40Z

❌ Preview Environment deleted from Bunnyshell

Available commands (reply to this comment):

🚀 /bns:deploy to deploy the environment

codecov · 2025-07-01T23:41:58Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.17%. Comparing base (d5383de) to head (cc2f650).
⚠️ Report is 32 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #23631      +/-   ##
==========================================
- Coverage   60.18%   60.17%   -0.01%     
==========================================
  Files         346      346              
  Lines       59248    59249       +1     
==========================================
- Hits        35656    35652       -4     
- Misses      20730    20732       +2     
- Partials     2862     2865       +3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

agaudreault · 2025-07-02T16:57:59Z

@jagpreetstamber do you mind validating this issue/pr?

agaudreault · 2025-07-02T17:07:50Z

util/git/creds.go

-		return nil
-	}), env, nil
+	var env []string
+	env = append(env, fmt.Sprintf("%s=Authorization: Bearer %s", bearerAuthHeaderEnv, token))


I don't see a reason to remove the credsStore. Perhaps the only change necessary is to do an approach similar to HTTPSCreds?

argo-cd/util/git/creds.go

Lines 243 to 246 in c60a727

} else if creds.bearerToken != "" {

// If bearer token is set, we will set ARGOCD_BEARER_AUTH_HEADER to hold the HTTP authorization header

env = append(env, fmt.Sprintf("%s=%s", bearerAuthHeaderEnv, creds.BearerAuthHeader()))

}

Initially I had left it in there, but then I realized it ultimately becomes unused (because it doesn't work as-is). But I can definitely restore it if you'd prefer that.

mikebordon · 2025-07-07T15:44:42Z

Hi @agaudreault. Have you had a chance to review after the last push to incorporate your requested change? Please let me know if you have any other concerns which I can address.

Signed-off-by: Mike Bordon <mikebordon@gmail.com>

mikebordon · 2025-07-23T15:22:11Z

@agaudreault This PR is still blocked by your previous change for request. Could you please re-review when you have a chance (or clear your vote since @rumstead has now approved)?

rumstead · 2025-08-15T15:56:34Z

/cherry-pick release-3.1

…23478) (argoproj#23631) Signed-off-by: Mike Bordon <mikebordon@gmail.com>

…23478) (argoproj#23631) Signed-off-by: Mike Bordon <mikebordon@gmail.com> Signed-off-by: rumstead <37445536+rumstead@users.noreply.github.com>

…23631) (#24223) Signed-off-by: Mike Bordon <mikebordon@gmail.com> Signed-off-by: rumstead <37445536+rumstead@users.noreply.github.com> Co-authored-by: mikebordon <31316193+mikebordon@users.noreply.github.com>

…23631) (#24222) Signed-off-by: Mike Bordon <mikebordon@gmail.com> Signed-off-by: rumstead <37445536+rumstead@users.noreply.github.com> Co-authored-by: mikebordon <31316193+mikebordon@users.noreply.github.com>

…23478) (argoproj#23631) Signed-off-by: Mike Bordon <mikebordon@gmail.com> Signed-off-by: enneitex <etienne.divet@gmail.com>

…23478) (argoproj#23631) Signed-off-by: Mike Bordon <mikebordon@gmail.com>

mikebordon force-pushed the fix/azure-workload-identity-repos-p2 branch from 1397e2a to cf6f56e Compare July 2, 2025 12:56

mikebordon marked this pull request as ready for review July 2, 2025 13:40

mikebordon requested a review from a team as a code owner July 2, 2025 13:40

agaudreault requested changes Jul 2, 2025

View reviewed changes

mikebordon force-pushed the fix/azure-workload-identity-repos-p2 branch 2 times, most recently from a1b19e8 to f77c759 Compare July 2, 2025 20:31

mikebordon requested a review from agaudreault July 2, 2025 21:21

mikebordon force-pushed the fix/azure-workload-identity-repos-p2 branch 2 times, most recently from 5107b7d to 53997fe Compare July 11, 2025 14:58

mikebordon force-pushed the fix/azure-workload-identity-repos-p2 branch from 53997fe to 7419946 Compare July 21, 2025 14:28

mikebordon added 2 commits July 22, 2025 09:06

Send Azure DevOps token via git extra headers

8d0cd95

Signed-off-by: Mike Bordon <mikebordon@gmail.com>

Restore CredsStore, per PR feedback

cc2f650

Signed-off-by: Mike Bordon <mikebordon@gmail.com>

mikebordon force-pushed the fix/azure-workload-identity-repos-p2 branch from 7419946 to cc2f650 Compare July 22, 2025 14:06

mikebordon mentioned this pull request Jul 22, 2025

Unable to use workload identity for AzureDevops repository #23478

Closed

3 tasks

rumstead approved these changes Jul 23, 2025

View reviewed changes

agaudreault approved these changes Jul 29, 2025

View reviewed changes

agaudreault merged commit 796f72c into argoproj:master Jul 29, 2025
28 checks passed

rumstead pushed a commit to rumstead/argo-cd that referenced this pull request Aug 21, 2025

fix(server): Send Azure DevOps token via git extra headers (argoproj#…

637f3c2

…23478) (argoproj#23631) Signed-off-by: Mike Bordon <mikebordon@gmail.com>

rumstead mentioned this pull request Aug 21, 2025

fix(server): Send Azure DevOps token via git extra headers (#23478) (#23631) #24223

Merged

14 tasks

downfa11 pushed a commit to downfa11/argo-cd that referenced this pull request Aug 25, 2025

fix(server): Send Azure DevOps token via git extra headers (argoproj#…

3b7d384

…23478) (argoproj#23631) Signed-off-by: Mike Bordon <mikebordon@gmail.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(server): Send Azure DevOps token via git extra headers (#23478) #23631

fix(server): Send Azure DevOps token via git extra headers (#23478) #23631

Uh oh!

mikebordon commented Jul 1, 2025 •

edited

Loading

Uh oh!

bunnyshell bot commented Jul 1, 2025 •

edited

Loading

Uh oh!

codecov bot commented Jul 1, 2025 •

edited

Loading

Uh oh!

agaudreault commented Jul 2, 2025

Uh oh!

agaudreault Jul 2, 2025

Uh oh!

mikebordon Jul 2, 2025

Uh oh!

mikebordon commented Jul 7, 2025

Uh oh!

mikebordon commented Jul 23, 2025

Uh oh!

Uh oh!

rumstead commented Aug 15, 2025

Uh oh!

Uh oh!

	} else if creds.bearerToken != "" {
	// If bearer token is set, we will set ARGOCD_BEARER_AUTH_HEADER to hold the HTTP authorization header
	env = append(env, fmt.Sprintf("%s=%s", bearerAuthHeaderEnv, creds.BearerAuthHeader()))
	}

fix(server): Send Azure DevOps token via git extra headers (#23478) #23631

fix(server): Send Azure DevOps token via git extra headers (#23478) #23631

Uh oh!

Conversation

mikebordon commented Jul 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bunnyshell bot commented Jul 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Preview Environment deleted from Bunnyshell

Uh oh!

codecov bot commented Jul 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

agaudreault commented Jul 2, 2025

Uh oh!

agaudreault Jul 2, 2025

Choose a reason for hiding this comment

Uh oh!

mikebordon Jul 2, 2025

Choose a reason for hiding this comment

Uh oh!

mikebordon commented Jul 7, 2025

Uh oh!

mikebordon commented Jul 23, 2025

Uh oh!

Uh oh!

rumstead commented Aug 15, 2025

Uh oh!

Uh oh!

mikebordon commented Jul 1, 2025 •

edited

Loading

bunnyshell bot commented Jul 1, 2025 •

edited

Loading

codecov bot commented Jul 1, 2025 •

edited

Loading