Azure devops use service connection for authentication

[ArnaudB88]

Tell us more.

If you want to connect to a DevOps private feed, you need to add a 'hostRules' config with username and password.
It would be better to allow specifying a devops service connection. The needed service connection possibly already exists to allow CI pipelines to build the solution.
A simple name specification can be enough. We currently use the service connection in our pipeline with the 'nuget authenticate' task.

[dsteeley]

I've got a draft implementation for DevOps Git authentication via the azure_identity library. I think this would support your scenario as a service connection would provide environment authentication that Renovate could use in CI and you wouldn't need to provide Username & Password or a token.

[ArnaudB88]

@secustor This suggestion is a requirement when 'Advanced security' is enabled in devops.
When enabled, it is not possible to push code with secrets included. The hostrule config (username password/PAT) will be blocked which prevents activating renovatebot on a repository.

[rarkins]

Renovate doesn't have a requirement that you add passwords in plain text. It's recommended that you use privateKey/encrypted for hostRules credentials

[dsteeley]

2nding the above. When using Renovate with AzureDevOps I pass in the password/token via environment variables. Azure Pipelines then redacts the token automatically.