release/8.0 VMR synchronization GitHub token acquisition fails after Key Vault signing

[mthalman]

Describe the Bug

The release/8.0.1xx VMR synchronization pipeline fails while acquiring a GitHub token. Azure login and Key Vault JWT signing succeed, but the token-acquisition wrapper exits with code 1 without reporting which downstream operation failed.

Pipeline: installer-dotnet-dotnet-synchronization (1226)
Build: https://dev.azure.com/dnceng/internal/_build/results?buildId=3047183
Exit code: 1

The available log does not identify whether the subsequent failure occurs during GitHub App token exchange, installation selection, or another operation.

Suspected root cause: Token acquisition fails after JWT signing, with the precise downstream error absent from the available diagnostics.

Confidence: Medium.

Steps to Reproduce

1. Run the release/8.0.1xx VMR synchronization pipeline.
2. Observe that Azure login and Key Vault JWT signing complete successfully.
3. The GitHub token-acquisition wrapper then exits with code 1 without identifying the failing downstream operation.

Other Information

Suggested next steps:

1. Enable diagnostic tracing for the token-acquisition wrapper and its downstream operations.
2. Verify the GitHub App installation, permissions, and JWT timing.
3. Determine whether the failure is transient or configuration-related before rerunning the synchronization.

[github-actions]

🏷️ Source-build triage pass — 2026-08-14 16:19 UTC

📋 Classification

Field	Value
Area	area-infra
Additional area(s)	area-release-infra
Kind	bug
Severity	S2 — VMR synchronization pipeline is blocked for release/8.0.1xx; workaround requires manual investigation of token-acquisition diagnostics
Affected version(s)	.NET 8
Repro	yes-verbose — pipeline build ID and steps to reproduce provided, but precise error not captured in available logs

🚦 Priority

• Blocking: blocking-clean-ci — VMR synchronization pipeline failing prevents automated sync for release/8.0
• Urgency: 🔴 current release — active release branch pipeline failure

  Ongoing failure in release/8.0.1xx VMR synchronization needs prompt resolution to unblock downstream processes.

👥 Routing

• Team: @dotnet/source-build
• Possible SME(s): mthalman, mmitche
  • mthalman — issue author; active on VMR synchronization and release-infra issues (e.g., release/9.0 VMR synchronization uses an invalid Aspire repository mapping #5640, Feature band release PRs timing issue #5636)
  • mmitche — commented on related VMR sync token issue release/9.0 VMR synchronization uses an invalid Aspire repository mapping #5640 with knowledge of per-org token scoping

🔗 Cross-references

• Recommended labels: add area-infra, add area-release-infra
• Related issues: release/9.0 VMR synchronization uses an invalid Aspire repository mapping #5640 (similar VMR sync failure on release/9.0 — token/org access issue)
• Possible duplicate of: none

✅ Assessment

• Confidence: medium
• Needs human?: yes — root cause is ambiguous (transient vs. configuration); needs diagnostic tracing to determine exact failure point

---

Restricted mode — no labels or milestone applied. A maintainer should manually apply any accepted labels and milestone.

Generated by Triage · 70.8 AIC · ⌖ 11.4 AIC · ⊞ 24.6K · ◷

[mthalman]

Fixed. PAT rotated.