[release/8.0.1xx] Replace VMR synchronization push PAT with a GitHub app auth

eng/pipelines/templates/jobs/vmr-synchronization.yml

@@ -69,13 +69,32 @@ jobs:
   - ${{ if and(not(parameters.noPush), not(in(variables['Build.Reason'], 'PullRequest')), eq(variables['System.TeamProject'], 'internal')) }}:
     # Push main and release branches to the public VMR
     - ${{ if or(eq(parameters.vmrBranch, 'main'), startsWith(parameters.vmrBranch, 'release/')) }}:
+      # The template that signs GitHub App tokens does not support multi-repo checkout, so we need this workaround
+      - script: |
+          target_dir='$(System.DefaultWorkingDirectory)/eng/common'
+          mkdir -p "$target_dir"
+          cp -r Get-GitHubAppToken.ps1 "$target_dir/Get-GitHubAppToken.ps1"
+          cp -r pipeline-logging-functions.ps1 "$target_dir/pipeline-logging-functions.ps1"
+        displayName: Prepare scripts for GitHub App token generation
+        workingDirectory: $(Build.Repository.LocalPath)/eng/common
+
+      - template: /eng/common/templates-official/steps/get-github-app-token.yml
+        parameters:
+          azureSubscription: DncEng-VSTS
+          keyVaultName: dnceng-pipeline-secrets
+          keyName: vmr-synchronization-app-secret
+          appClientId: $(vmr-synchronization-app-client-id)
+          installationOwner: dotnet
+          outputVariableName: vmrPushToken
+          displayName: Get GitHub token for pushing to dotnet/dotnet
+
       - script: >
           ./.dotnet/dotnet darc vmr push
           --vmr '$(vmrPath)'
           --commit-verification-pat '$(BotAccount-dotnet-maestro-bot-no-scopes-PAT)'
           --branch '${{ parameters.vmrBranch }}'
           --remote-url '$(vmrPublicUrl)'
-          --github-pat '$(BotAccount-dotnet-bot-repo-PAT)'
+          --github-pat '$(vmrPushToken)'
           --debug
         displayName: Push changes to dotnet/dotnet (public)
         workingDirectory: $(Agent.BuildDirectory)/installer