Azure DevOps Pipelines and GitHub Repository Integration: Can OIDC Federation Replace PATs for Source Access?

Goal: Assess whether Azure DevOps Pipelines can authenticate to a GitHub repository using federated OIDC credentials instead of a personal access token or OAuth token stored in a service connection, enabling PAT‑less CI/CD workflows.

Constraints: Current documentation for GitHub service connections in Azure DevOps lists only OAuth token and personal access token as authentication methods, with no mention of OIDC federation for the source connector; federated credentials are documented for Azure resource access from GitHub Actions, not the reverse direction. This creates uncertainty about whether the pipeline can leverage the same federation flow or must rely on workarounds such as Azure CLI tasks that exchange federated tokens for Azure access.

Specific questions: Does Azure DevOps support configuring a GitHub service connection that accepts federated OIDC credentials in place of a PAT or OAuth token? If not, what are the officially supported alternatives for achieving PAT‑less authentication when a pipeline needs to clone or fetch a GitHub repository? Are there any version‑specific limitations or preview features that enable OIDC‑based source connections in Azure DevOps Services or Server?