Going secretless for Azure DevOps access

[BillWagner]

First draft at using secretless authentication for Azure Dev Ops access.

[IEvangelist]

LGTM.

[Copilot]

Pull request overview

This PR is a first pass at enabling “secretless” Azure DevOps authentication for the sequester tooling by introducing an Azure DevOps bearer access token path (OIDC/OAuth) alongside the existing PAT-based flow.

Changes:

• Add a new QuestAccessToken option sourced from environment variables and workflow OIDC output.
• Thread a useBearerToken flag through service construction and update QuestClient to support Bearer vs Basic auth headers.
• Update the bulk workflow to acquire an Azure DevOps OIDC token and pass it to the action.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
actions/sequester/Quest2GitHub/QuestGitHubService.cs	Adds useBearerToken, but currently still constructs the AzDO client with QuestKey regardless (blocks secretless auth).
actions/sequester/Quest2GitHub/Options/EnvironmentVariableReader.cs	Reads new QuestAccessToken and makes PAT optional, creating a mismatch with ApiKeys.QuestKey being required.
actions/sequester/Quest2GitHub/Options/ApiKeys.cs	Introduces QuestAccessToken, but its XML docs are currently incorrect/misleading.
actions/sequester/Quest2GitHub/AzDoClientServices/QuestClient.cs	Supports Bearer auth, but adds response-body logging and double-reads the content (security/robustness issue).
actions/sequester/ImportIssues/Program.cs	Wires through useBearerToken and validates token presence; also adds an unused using.
.github/workflows/quest-bulk.yml	Adds Azure DevOps OIDC auth step and passes QuestAccessToken; pins sequester action to a feature branch ref.

Comments suppressed due to low confidence (1)

actions/sequester/Quest2GitHub/Options/EnvironmentVariableReader.cs:31

• QuestKey is now read as optional, but ApiKeys.QuestKey is still declared as a required non-nullable string. That combination can produce null values at runtime (the reader returns value!) and makes it unclear which token is actually required. Consider making QuestKey nullable (and validating based on auth mode) or requiring it only when bearer auth isn’t used.

        var azureAccessToken = CoalesceEnvVar(("ImportOptions__ApiKeys__AzureAccessToken", "AZURE_ACCESS_TOKEN"), false);

        // This key is the PAT for Quest access. It's now a legacy key. Secretless should be better.
        var questKey = CoalesceEnvVar(("ImportOptions__ApiKeys__QuestKey", "QuestKey"), false);

        if (!int.TryParse(appIDString, out int appID)) appID = 0;

        return new ApiKeys()
        {
            GitHubToken = githubToken,
            QuestAccessToken =  questToken,
            AzureAccessToken = azureAccessToken,
            QuestKey = questKey,
            SequesterPrivateKey = oauthPrivateKey,
            SequesterAppID = appID

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[BillWagner]

This looks good. Let's go over it and then I'll get this merged and deployed.

[ramiMSFT]

This looks good. Let's go over it and then I'll get this merged and deployed.

Thanks @BillWagner! Let me know if you have any other suggestions