msstore reconfigure currently accepts only a client secret or a certificate. Entra ID client secrets are capped at 24 months, which makes CI publishing pipelines fail silently when the secret expires (this just broke Julia's store publishing: JuliaLang/juliaup run 32465108486, three channels down with 401s).
GitHub Actions and Azure DevOps both support OIDC workload identity federation, and Entra app registrations accept federated credentials — no stored, expiring secret at all. Since the CLI is .NET, Azure.Identity's WorkloadIdentityCredential (or accepting a pre-acquired access token for https://manage.devcenter.microsoft.com, e.g. from azure/login + az account get-access-token) would cover it. Either mechanism — native federated auth or an --accessToken option on reconfigure — would let CI pipelines drop long-lived secrets entirely.
msstore reconfigurecurrently accepts only a client secret or a certificate. Entra ID client secrets are capped at 24 months, which makes CI publishing pipelines fail silently when the secret expires (this just broke Julia's store publishing: JuliaLang/juliaup run 32465108486, three channels down with 401s).GitHub Actions and Azure DevOps both support OIDC workload identity federation, and Entra app registrations accept federated credentials — no stored, expiring secret at all. Since the CLI is .NET,
Azure.Identity's WorkloadIdentityCredential(or accepting a pre-acquired access token for https://manage.devcenter.microsoft.com, e.g. fromazure/login+az account get-access-token) would cover it. Either mechanism — native federated auth or an--accessTokenoption onreconfigure— would let CI pipelines drop long-lived secrets entirely.