Update trigger template with managed identity settings (#46)

.github/workflows/backport-action.yml

@@ -24,6 +24,15 @@ on:
         required: false
         default: false
     secrets:
+      azure_tenant_id:
+        description: Tenant associated with the managed identity used to log into Azure
+        required: false
+      azure_subscription_id:
+        description: Subscription associated with the managed identity used to log into Azure
+        required: false
+      azure_client_id:
+        description: Client id associated with the managed identity used to log into Azure
+        required: false
       ado_organization:
         description: Azure DevOps organization that hosts the backport job
         required: true
@@ -33,12 +42,12 @@ on:
       backport_pipeline_id:
         description: ID of the backport yaml pipeline in Azure DevOps
         required: true
-      ado_build_pat:
-        description: PAT of an account that can launch builds on the backport pipeline in Azure DevOps
-        required: true
       github_account_pat:
         description: PAT for a github account that has write access to source repository
         required: true
+      ado_build_pat:
+        description: PAT of an account that can launch builds on the backport pipeline in Azure DevOps
+        required: false
 jobs:
   launch_ado_build:
     runs-on: ubuntu-latest
@@ -49,6 +58,7 @@ jobs:
       actions: none
       contents: read
       security-events: none
+      id-token: none
     env:
       # Protect against script injection attacks via input variables (i.e., the content of the variables could be executed at the time of evaluation/expansion within a script)
       # Scripts must consume the environment variable settings instead

.github/workflows/backport-trigger.yml

@@ -33,15 +33,26 @@ jobs:
   launchBackportBuild:
     needs: setupBackport
     uses: xamarin/backport-bot-action/.github/workflows/[email protected]
+    # GITHUB_TOKEN change from read-write to read-only on 2024-02-01 requiring permissions block
+    # https://docs.opensource.microsoft.com/github/apps/permission-changes/
+    # https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
+    permissions:
+      actions: none
+      contents: read
+      security-events: none
+      id-token: write           # The backport-action template being invoked requires this permission
     with:
       pull_request_url: ${{ github.event.issue.pull_request.url }}
       target_branch: ${{ needs.setupBackport.outputs.target_branch }}
       comment_author: ${{ github.actor }}
       github_repository: ${{ github.repository }}
       use_fork: false
     secrets:
+      azure_tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+      azure_subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      azure_client_id: ${{ secrets.AZURE_CLIENT_ID }}
       ado_organization: ${{ secrets.ADO_PROJECTCOLLECTION }}
       ado_project: ${{ secrets.ADO_PROJECT }}
       backport_pipeline_id: ${{ secrets.BACKPORT_PIPELINEID }}
-      ado_build_pat: ${{ secrets.ADO_BUILDPAT }}
       github_account_pat: ${{ secrets.SERVICEACCOUNT_PAT }}
+      ado_build_pat: ${{ secrets.ADO_BUILDPAT }}