Is it possible to authenticate your packaging orgs using a connected app in your DevHub org using jwt auth flow?

Question

We are using github actions and cumulusci as part of our ci/cd pipeline. In each of our repositories (packages in SF context), we have a .github/workflows folder and inside it are our yaml files that trigger automatically based on events. One such event, for example, is whenever a new pull request is opened. When a PR is opened, part of the workflow is creating a scratch org and deploying the new changes to that scratch org to ensure that everything works properly before those changes can actually be merged into our develop branch. We use a connected app in our DevHub to authenticate the scratch orgs. This is done automatically by running

sfdx auth:jwt:grant --clientid 04580y4051234051
--jwtkeyfile /Users/jdoe/JWT/server.key --username [email protected]
--setdefaultdevhubusername --setalias my-hub-org

The clientid is the consumer key that is generated when you create a connected app and the jwtkeyfile is a private key.

However, we also have another workflow specifically for our packaging orgs. The purpose of this is to automate our releases. Are we able to use our DevHub org to authenticate packaging orgs, similarly to what we're doing to scratch orgs? Or, does the connected app have to live in our packaging org instead?

Answer 1

After doing some more digging, I realize my question is from a lack of understanding of DevHubs, scratch orgs, and the relationship between the two. If you create a connected app in your devhub, you can indeed use the same consumer key for the connected app to authorize associated scratch orgs. Packaging orgs have no relation to a Devhub org other than linking the two via namespace registries. Understandably, you cannot use a consumer key that is unique to one org to authenticate against other orgs.