fix: remove GitHub MCP token and encrypt MSBench CAPI env - #3112
Merged
Sai Koumudi Kaluvakolanu (saikoumudi) merged 1 commit intoAug 25, 2026
Merged
Conversation
Remove the unused GitHub MCP PAT from Azure benchmark submissions and pass CAPI credentials through encrypted environment arguments. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Sai Koumudi Kaluvakolanu (saikoumudi)
requested a review
from a team
as a code owner
August 25, 2026 01:04
Copilot started reviewing on behalf of
Sai Koumudi Kaluvakolanu (saikoumudi)
August 25, 2026 01:07
View session
Contributor
There was a problem hiding this comment.
Pull request overview
This change updates the Azure DevOps MSBench submission script to decouple MSBench CAPI authentication from GitHub MCP authentication by removing the unused GitHub PAT flow and ensuring CAPI credentials are passed to MSBench via encrypted environment variables.
Changes:
- Removed retrieval/forwarding of the unused
azure-eval-gh-pat/GITHUB_MCP_SERVER_TOKEN. - Kept retrieving CAPI Integration ID + HMAC from Key Vault and registering them as pipeline secrets (masked).
- Passed
CAPI_INTEGRATION_IDandCAPI_HMAC_KEYtomsbench-cli runvia--encrypted-env, keeping non-secret config in--env.
Show a summary per file
| File | Description |
|---|---|
| pipelines/scripts/Invoke-RunBenchmarks.ps1 | Removes GitHub MCP token handling and switches MSBench invocation to use --encrypted-env for CAPI credentials. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 1/1 changed files
- Comments generated: 2
- Review effort level: Lite
JasonYeMSFT (JasonYeMSFT)
approved these changes
Aug 25, 2026
Sai Koumudi Kaluvakolanu (saikoumudi)
deleted the
skaluvak-microsoft-secure-msbench-capi-env
branch
August 25, 2026 17:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Separates Azure MSBench authentication from GitHub MCP authentication for the Azure benchmark submission path:
azure-eval-gh-pat/GITHUB_MCP_SERVER_TOKENkv-msbench-eval-azuremcpwithout logging their valuesCAPI_INTEGRATION_IDandCAPI_HMAC_KEYthrough--encrypted-envUSE_COPILOT_CLI_VERSIONunder--envMSBench run
2026082502422012validated this separation withazure.enterprise_infra_planner_skillon direct modelclaude-opus-4.5: encrypted CAPI credentials, no GitHub MCP token, and 1/1 resolved (100%).Checklist
fix:,feat:,feature:,chore:,misc:,test:,eval:Related Issues
Related to microsoft/mcp-pr#648.