Add CFSClean enforcement

[chidozieononiwu]

This pull request makes a small change to the pipeline configuration by updating the networkIsolationPolicy setting. The policy is now set to include both Permissive and CFSClean, which may affect how network isolation is enforced during pipeline runs.

• Pipeline configuration:
  • Updated the networkIsolationPolicy in eng/pipelines/templates/stages/1es-redirect.yml to include CFSClean in addition to Permissive.

azure-dev - ext - microsoft.azd.demo
azure-dev - cli

Resolves #9221

[azure-pipelines]

Azure Pipelines:
22 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Enables CFSClean enforcement across pipelines using the shared 1ES redirect template.

Changes:

• Adds CFSClean to the network isolation policy.

[jongio]

Verified the multi-value syntax against 1ES usage across the org - Permissive, CFSClean is the standard comma-separated policy format. The prior golang internalModuleProxy setup lines up with enforcing CFSClean, so the network isolation tightening has the internal mirror in place. Scoped and correct.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[jongio]

Re-checked after the demo extension version bump to 0.7.2. version.txt, extension.yaml, and the CHANGELOG entry all line up, and it's a no-op test release to exercise the CFSClean pipeline change. Still good.

[chidozieononiwu]

/check-enforcer override

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

[jongio]

The two new templates added under eng/common/pipelines/templates/steps/ (maven-authenticate.yml and pypi-auth-dev-feed.yml) sit in the directory that is mirrored from azure-sdk-tools. eng/common/README.md warns that changes here get overwritten by the common-engineering sync.

I checked azure-sdk-tools/eng/common/pipelines/templates/steps and neither file exists upstream (the closest is a differently-named auth-dev-feed.yml). So the next sync will delete both files, and the callers that reference them, eng/pipelines/templates/jobs/build-cli.yml and eng/pipelines/templates/stages/build-and-test.yml, will then fail with a missing-template error.

Move both templates to eng/pipelines/templates/steps/ where the other repo-specific steps live (e.g. install-ms-openjdk.yml, setup-go.yml) and update the two template: references, or land them upstream in azure-sdk-tools first and consume them through the normal common-engineering update.

nuget.config and eng/settings.xml at the repo root look fine.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (2)

eng/common/pipelines/templates/steps/pypi-auth-dev-feed.yml:1

• azd-code-reviewer: eng/common is synchronized from Azure/azure-sdk-tools, and eng/common/README.md:3 says local changes here will be overwritten; the workflow enforcer also rejects them (eng-common-workflow-enforcer.yml:12-19). Move this repo-specific template under eng/pipelines/templates/steps and update its call site, or bring the canonical template in through the eng/common sync workflow.

parameters:

eng/common/pipelines/templates/steps/maven-authenticate.yml:1

• azd-code-reviewer: eng/common is synchronized from Azure/azure-sdk-tools, and eng/common/README.md:3 says local changes here will be overwritten; the workflow enforcer also rejects them (eng-common-workflow-enforcer.yml:12-19). Move this repo-specific template under eng/pipelines/templates/steps and update its call site, or add it via the eng/common sync workflow.

parameters:

[jongio]

Re-reviewed the latest commit. Dropping the root nuget.config and scoping the restore with feedsToUse: select and vstsFeed: 'public/azure-sdk-for-net' in build-msi.yml keeps the windows.sln restore (the only NuGet restore in the repo) on the ADO mirror under CFSClean, so that change is self-contained and introduces no new issues.

One blocker from the earlier pass is still open: maven-authenticate.yml and pypi-auth-dev-feed.yml live under eng/common, which is overwritten by the azure-sdk-tools sync (see eng/common/README.md:3), and neither file exists upstream in azure-sdk-tools. The next common-engineering sync will delete both and break the template references in build-cli.yml and build-and-test.yml. Move them under eng/pipelines/templates/steps/ (next to setup-go.yml and install-ms-openjdk.yml), or land them upstream in azure-sdk-tools first, before merging.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

eng/pipelines/templates/stages/1es-redirect.yml:35

• azd-code-reviewer: This enables CFSClean for every pipeline that extends this template, but the feed migration is incomplete. For example, eng/pipelines/eval-unit.yml still runs npm ci and pip install pytest directly, and the eval report/E2E pipelines also use unauthenticated npm installs; there is no repository .npmrc, and the new PyPI auth template is used only by GenerateReleaseArtifacts. Those jobs will lose access to public registries under CFSClean. Add the appropriate npm/PyPI feed authentication to every affected job, or scope the policy rollout until all consumers are migrated.

      networkIsolationPolicy: Permissive, CFSClean

[jongio]

The only change since my last look is the repo-root NuGet.Config, which clears inherited feeds and pins restores to the azure-sdk-for-net feed (nuget.org upstream). That matches the CFSClean goal. It merges cleanly with the existing cli/installer/windows-actions/nuget.config (repositoryPath only), and the Windows MSI restore is the only .NET restore affected. CI is green.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

eng/pipelines/templates/stages/build-and-test.yml:161

• [azd-code-reviewer] This job only performs a pip install (line 203), but the template defaults also enable Twine and uv authentication. Disable those two unused modes here so the job does not create unnecessary credential-bearing configuration or add unrelated authentication failure points.

          - template: /eng/common/pipelines/templates/steps/pypi-auth-dev-feed.yml

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

[jongio]

Re-reviewed the two new commits since my last pass. build-cli.yml now pulls in create-authenticated-npmrc.yml, and that template picked up defaults for npmrcPath (empty resolves to $HOME/.npmrc) and registryUrl (the azure-sdk-for-js feed), with the resolved path carried into npmAuthenticate through the resolvedNpmrcPath variable. I diffed it against azure-sdk-tools eng/common and it matches upstream exactly, so the common-engineering sync won't revert it and the earlier no-defaults invocation error on build-cli.yml is cleared. This is the upstream-first path.

The same treatment still needs to happen for maven-authenticate.yml and pypi-auth-dev-feed.yml (neither exists upstream in azure-sdk-tools yet), but that's the standing item from my earlier reviews, not something these two commits introduced. The npmrc change itself is scoped and correct.