Replace dn-bot PAT with WIF token for internal VMR push (8.0.2xx)

[missymessa]

AB#10139

Migrate the darc vmr push command for internal/release branches from using the dn-bot-dnceng-build-rw-code-rw PAT (via DotNetBot-AzDO-PAT variable group) to a WIF-minted Entra token obtained through the dnceng-build-rw-code-rw-wif service connection. ## Changes - Added an AzureCLI@2 step that authenticates via the dnceng-build-rw-code-rw-wif service connection and mints an AzDO bearer token - Replaced --azdev-pat with WIF-minted token in the internal VMR push step ## Context Part of a set of PRs migrating this PAT across all active release branches: - #20821 (release/8.0.4xx) - #20822 (release/8.0.1xx) - This PR (release/8.0.2xx) Part of PAT migration work item: https://dev.azure.com/dnceng/internal/_workitems/edit/10139 ## Prerequisites Before merging, the dnceng-build-rw-code-rw-wif service principal needs: 1. Enrollment in the dnceng AzDO org 2. Contribute permission on the dotnet-dotnet repo 3. Bypass policies when pushing on the dotnet-dotnet repo

[Copilot]

Pull request overview

Migrates internal VMR push authentication from a stored PAT to a WIF-minted Azure DevOps bearer token for internal/release/* branches.

Changes:

• Adds an AzureCLI@2 step intended to mint an AzDO access token via the dnceng-build-rw-code-rw-wif service connection.
• Updates the darc vmr push invocation to use the minted token instead of the dn-bot-dnceng-build-rw-code-rw PAT.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[missymessa]

Force-pushed to fix broken YAML from the original commit. The previous version had the AzureCLI@2 task incorrectly merged into a script: step and a truncated --azdev-pat argument. The updated commit cleanly adds the WIF token minting step as a separate task: AzureCLI@2 before the darc vmr push script step, with proper error handling for token acquisition.

[missymessa]

Build Failure Analysis

The build failure is not related to this PR's change. The failing job (\Windows_NT_Build_Debug_x64) errors during toolset restore:

\
404 (Not Found - TF1600012: The feed 'darc-pub-dotnet-emsdk-08a90ca2' (3531a305-b207-4b6f-8351-da39baef9599) has been disabled.)
\\

This causes \Microsoft.DotNet.Arcade.Sdk\ resolution to fail. The disabled feed is a pre-existing issue on the
elease/8.0.2xx\ branch — any PR targeting this branch would hit the same failure. Our change only modifies \�ng/pipelines/templates/jobs/vmr-synchronization.yml\ and does not touch NuGet configuration.

[marcpopMSFT]

2xx and 3xx are out of support so you don't have to worry about those branches. only 1xx and 4xx.