Keyless Build Promotion publishing + null-guard in SetupTargetFeedConfigV3 (durable fix for #17185 regression)

[missymessa]

Durable fix — re-apply keyless Entra publishing, with task null-guard

This is the follow-up to #17186 (which reverted #17185 to stop production Build Promotion failures). It re-applies the keyless publish.yml change and fixes the root-cause null-reference in the publishing task so keyless is actually safe.

Two changes

1. SetupTargetFeedConfigV3.cs — null-guard feedKeys/feedOverrides (matches the guard already present in SetupTargetFeedConfigV4). When publishing keyless (Entra/WIF), the FeedKey MSBuild item is empty, so the task's FeedKeys parameter arrives null. Previously .ToImmutableDictionary() threw ArgumentNullException before auth ran:

   PublishArtifactsInManifest.proj(129,5): error : Value cannot be null. (Parameter 'source')
      at ...SetupTargetFeedConfigV3..ctor line 74
   

   With the guard, null feedKeys yields an empty dictionary and the publisher falls back to Entra auth as intended.
2. eng/publishing/v3/publish.yml — keyless (re-applies Remove AzureDevOpsFeedsKey from Build Promotion publish.yml (keyless Entra publishing) #17185): removes AzureDevOpsFeedsKey and the enable-cross-org-publishing.ps1 -token step; publishing runs under the maestro-build-promotion federated identity.

⚠️ DO NOT MERGE until the null-guard is deployed to the Build Promotion pipeline

The publishing task ships in the arcade SDK pinned by global.json. The keyless publish.yml change is only safe once the fixed task (with the null-guard from change #1) is the version actually used by Build Promotion. Required order:

1. Merge Revert #17185: restore AzureDevOpsFeedsKey (task NREs on null FeedKeys, breaking prod promotions) #17186 (revert) — unblock prod. ✅ prerequisite
2. Land the null-guard (change Add task package guidance #1) and build a new arcade SDK containing it.
3. Bump global.json (dependency flow) so Build Promotion consumes the fixed task.
4. Only then merge the keyless publish.yml change (change Create Microsoft.DotNet.Build.Tasks.IO #2).

Merging the keyless change before the fixed task is live will reproduce the #17185 regression. Kept as draft until the gate above is satisfied.

Context / prior regression

• Remove AzureDevOpsFeedsKey from Build Promotion publish.yml (keyless Entra publishing) #17185 (keyless, no guard) merged and broke prod: roslyn 3030919, dnceng-shared 3030947.
• Reverted by Revert #17185: restore AzureDevOpsFeedsKey (task NREs on null FeedKeys, breaking prod promotions) #17186.

[Copilot]

Pull request overview

Re-enables keyless (Entra/WIF) Build Promotion publishing while hardening the Arcade publishing task to handle null FeedKeys/FeedOverrides, preventing the regression where keyless publishing crashed before authentication.

Changes:

• Add a null-guard in SetupTargetFeedConfigV3 so missing MSBuild FeedKey/override items don’t cause ArgumentNullException during dictionary materialization.
• Re-apply keyless Build Promotion publishing in eng/publishing/v3/publish.yml by running publishing under the maestro-build-promotion federated identity (no PAT-based feeds key step).

Reviewed changes

Copilot reviewed 1 out of 1 changed files in this pull request and generated no comments.

File	Description
src/Microsoft.DotNet.Build.Tasks.Feed/src/model/SetupTargetFeedConfigV3.cs	Null-guards feedKeys/feedOverrides when ItemGroups are empty (keyless publishing scenario).
eng/publishing/v3/publish.yml	Keyless Build Promotion publishing configuration (auth via maestro-build-promotion, PAT-based feeds key not present).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[missymessa]

Split into two PRs for a safe staged rollout: #17188 (null-guard the task, mergeable now) and #17189 (re-apply keyless publish.yml, draft — gated on the null-guard fix being deployed via a global.json bump). Closing this combined PR.