[ci] Fix MAUI R2R Helix submissions for fork PRs

[simonrozsival]

Summary

• detect fork PR builds before starting MAUI R2R Helix submissions
• remove the unavailable System.AccessToken so the Helix SDK disables Azure Pipelines test reporting
• preserve anonymous Helix submission and test reporting for trusted builds
• verify fork and non-fork token inheritance in child PowerShell processes before running the submissions

Context

Fork PR submissions were failing before reaching Helix because AzurePipelines.MultiQueue.targets attempted to start an Azure Pipelines test run with the restricted fork token and received HTTP 401.

Example failure: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1577851&view=logs&jobId=7ec14a57-4d0d-5c34-dfba-b9061d40ba04

Behavior change

The MAUI R2R tests will still be submitted anonymously to Helix using an empty HelixAccessToken and the Creator identity. The submission task will continue waiting for Helix completion and will fail when a Helix work item fails.

For fork PRs, these runs will no longer create or update an Azure Pipelines test run, so their results will not appear in the Azure DevOps Tests tab. Removing System.AccessToken is scoped to the submission PowerShell process and its children; later pipeline tasks and non-fork builds are unchanged.

Validation

• added executable coverage for both fork and non-fork environment inheritance
• ran the regression script under PowerShell
• parsed the updated YAML template
• ran git diff --check

[Copilot]

Copilot review overview

🟢 Approval recommended

The change is narrowly scoped to CI template behavior and appears low-risk while addressing the reported fork-token 401 scenario.

Review tier: Lite
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	build-tools/​automation/​yaml-templates/​run-maui-r2r-helix-matrix.yaml — 💡 suggestion — Instead of setting SYSTEM_ACCESSTOKEN to an empty string, remove it from the…

What changed in this PR

Updates the MAUI R2R Helix submission YAML template to handle fork PR builds safely by preventing Azure Pipelines test reporting from using restricted tokens, while keeping existing behavior for trusted builds.

Changes:

• Detect fork PR builds via System.PullRequest.IsFork before starting Helix submissions.
• Clear SYSTEM_ACCESSTOKEN for fork PRs so Helix/MSBuild logic disables Azure Pipelines test reporting.
• Plumb SYSTEM_PULLREQUEST_ISFORK into the PowerShell step environment.

File	Description
build-tools/​automation/​yaml-templates/​run-maui-r2r-helix-matrix.yaml	Adds fork-PR detection and disables Azure Pipelines test reporting by clearing SYSTEM_ACCESSTOKEN during MAUI R2R Helix submissions.

[simonrozsival]

/review

[github-actions]

✅ Android PR Reviewer completed successfully!

Generated by Android PR Reviewer for #12641

[github-actions]

⚠️ Needs Changes

Findings: 0 errors, 1 warning. The environment removal is correctly scoped to the submission task and its child processes, and it preserves anonymous Helix submission. The fork-only behavior still needs regression coverage because this direct PR run cannot execute that branch.

CI is still in progress (2 checks passed, 6 running, 1 queued at review time), with no failures reported so far.

Generated by Android PR Reviewer for #12641 · gpt56 · 60.2 AIC · ⌖ 9.01 AIC · ⊞ 25.7K
_{Comment /review to run again}

[simonrozsival]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[simonrozsival]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).