From 0141a6ed1fb940699b2590e894a6cc882f64c3e8 Mon Sep 17 00:00:00 2001 From: Chidozie Ononiwu Date: Tue, 14 Jul 2026 16:51:35 -0700 Subject: [PATCH 1/8] Add CFSClean enforcement --- eng/pipelines/templates/stages/1es-redirect.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/eng/pipelines/templates/stages/1es-redirect.yml b/eng/pipelines/templates/stages/1es-redirect.yml index cecaeb8d7a2..4ee9a76cefa 100644 --- a/eng/pipelines/templates/stages/1es-redirect.yml +++ b/eng/pipelines/templates/stages/1es-redirect.yml @@ -32,7 +32,7 @@ extends: enabled: true settings: skipBuildTagsForGitHubPullRequests: true - networkIsolationPolicy: Permissive + networkIsolationPolicy: Permissive, CFSClean sdl: # Turn off the build warnings caused by disabling some sdl checks createAdoIssuesForJustificationsForDisablement: false From 7a16aadee99f6701830fefc018becc5bb4177191 Mon Sep 17 00:00:00 2001 From: Chidozie Ononiwu Date: Thu, 16 Jul 2026 09:52:54 -0700 Subject: [PATCH 2/8] Bump microsoft.azd.demo for testing --- cli/azd/extensions/microsoft.azd.demo/CHANGELOG.md | 4 ++++ cli/azd/extensions/microsoft.azd.demo/extension.yaml | 2 +- cli/azd/extensions/microsoft.azd.demo/version.txt | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/cli/azd/extensions/microsoft.azd.demo/CHANGELOG.md b/cli/azd/extensions/microsoft.azd.demo/CHANGELOG.md index 46cb38365da..729b0024c01 100644 --- a/cli/azd/extensions/microsoft.azd.demo/CHANGELOG.md +++ b/cli/azd/extensions/microsoft.azd.demo/CHANGELOG.md @@ -1,5 +1,9 @@ # Release History +## 0.7.2 (2026-07-16) + +- Simple test release of extension, with no changes. + ## 0.7.1 (2026-07-14) - Simple test release of extension, with no changes. diff --git a/cli/azd/extensions/microsoft.azd.demo/extension.yaml b/cli/azd/extensions/microsoft.azd.demo/extension.yaml index a5df615f6c5..2073a740a5b 100644 --- a/cli/azd/extensions/microsoft.azd.demo/extension.yaml +++ b/cli/azd/extensions/microsoft.azd.demo/extension.yaml @@ -4,7 +4,7 @@ namespace: demo displayName: Demo Extension description: This extension provides examples of the azd extension framework. usage: azd demo [options] -version: 0.7.1 +version: 0.7.2 language: go capabilities: - custom-commands diff --git a/cli/azd/extensions/microsoft.azd.demo/version.txt b/cli/azd/extensions/microsoft.azd.demo/version.txt index 39e898a4f95..7486fdbc50b 100644 --- a/cli/azd/extensions/microsoft.azd.demo/version.txt +++ b/cli/azd/extensions/microsoft.azd.demo/version.txt @@ -1 +1 @@ -0.7.1 +0.7.2 From 2d4010d0932120c4693cf9e3c63ba3502ce4ce1e Mon Sep 17 00:00:00 2001 From: Chidozie Ononiwu Date: Tue, 21 Jul 2026 18:44:13 -0700 Subject: [PATCH 3/8] Add nuget, python and maven authentication --- .../templates/steps/maven-authenticate.yml | 17 +++++++ .../templates/steps/pypi-auth-dev-feed.yml | 49 +++++++++++++++++++ eng/pipelines/templates/jobs/build-cli.yml | 3 ++ .../templates/stages/build-and-test.yml | 2 + eng/settings.xml | 13 +++++ nuget.config | 11 +++++ 6 files changed, 95 insertions(+) create mode 100644 eng/common/pipelines/templates/steps/maven-authenticate.yml create mode 100644 eng/common/pipelines/templates/steps/pypi-auth-dev-feed.yml create mode 100644 eng/settings.xml create mode 100644 nuget.config diff --git a/eng/common/pipelines/templates/steps/maven-authenticate.yml b/eng/common/pipelines/templates/steps/maven-authenticate.yml new file mode 100644 index 00000000000..1b84e984add --- /dev/null +++ b/eng/common/pipelines/templates/steps/maven-authenticate.yml @@ -0,0 +1,17 @@ +parameters: + SourceDirectory: $(Build.SourcesDirectory) + +steps: + # Copy mirror settings to default Maven location so all requests go through CFS + - pwsh: | + $m2Dir = if ($env:USERPROFILE) { "$env:USERPROFILE\.m2" } else { "$HOME/.m2" } + New-Item -ItemType Directory -Force -Path $m2Dir | Out-Null + Copy-Item -Path "${{ parameters.SourceDirectory }}/eng/settings.xml" -Destination "$m2Dir/settings.xml" + displayName: "Setup Maven mirror settings" + + # Authenticate with Azure Artifacts feeds + # MavenAuthenticate adds entries to ~/.m2/settings.xml matching mirror id 'azure-sdk-for-java' + - task: MavenAuthenticate@0 + displayName: "Maven Authenticate" + inputs: + artifactsFeeds: "azure-sdk-for-java" diff --git a/eng/common/pipelines/templates/steps/pypi-auth-dev-feed.yml b/eng/common/pipelines/templates/steps/pypi-auth-dev-feed.yml new file mode 100644 index 00000000000..fc2396c8448 --- /dev/null +++ b/eng/common/pipelines/templates/steps/pypi-auth-dev-feed.yml @@ -0,0 +1,49 @@ +parameters: + DevFeedName: "public/azure-sdk-for-python" + EnableTwineAuth: true + EnablePipAuth: true + EnableUvAuth: true + +steps: + - pwsh: | + # For safety default to publishing to the private feed. + # Publish to https://dev.azure.com/azure-sdk/internal/_packaging?_a=feed&feed=azure-sdk-for-python-pr + $devopsFeedName = 'internal/azure-sdk-for-python-pr' + if (-not ('$(Build.Repository.Name)').EndsWith('-pr')) { + # Publish to https://dev.azure.com/azure-sdk/public/_packaging?_a=feed&feed=azure-sdk-for-python + $devopsFeedName = '${{ parameters.DevFeedName }}' + } + echo "##vso[task.setvariable variable=DevFeedName]$devopsFeedName" + echo "Using DevopsFeed = $devopsFeedName" + displayName: Setup DevOpsFeedName + + - ${{ if eq(parameters.EnableTwineAuth, true) }}: + - task: TwineAuthenticate@0 + displayName: "Twine Authenticate to feed" + inputs: + artifactFeeds: $(DevFeedName) + + - ${{ if eq(parameters.EnablePipAuth, true) }}: + - task: PipAuthenticate@1 + displayName: "Pip Authenticate to feed" + inputs: + artifactFeeds: $(DevFeedName) + onlyAddExtraIndex: false + + - ${{ if eq(parameters.EnableUvAuth, true) }}: + - pwsh: | + if ($env:PIP_INDEX_URL) { + Write-Host "Found pip index URL: $($env:PIP_INDEX_URL)" + # UV_DEFAULT_INDEX is the canonical replacement for the deprecated UV_INDEX_URL (uv 0.4.23+). + # PIP_INDEX_URL is set by PipAuthenticate@1 and contains embedded credentials, which uv + # will use for Basic auth against the ADO feed (and its PyPI upstream) per astral-sh/uv#12651. + Write-Host "##vso[task.setvariable variable=UV_DEFAULT_INDEX]$($env:PIP_INDEX_URL)" + # Disable keyring so uv uses the URL-embedded credentials directly. + Write-Host "##vso[task.setvariable variable=UV_KEYRING_PROVIDER]disabled" + } else { + Write-Host "##[warning]PIP_INDEX_URL not set - uv will fall back to public PyPI." + } + # Force any managed Python downloads to go directly to GitHub releases + # rather than the default CDN (releases.astral.sh). + Write-Host "##vso[task.setvariable variable=UV_PYTHON_INSTALL_MIRROR]https://github.com/astral-sh/python-build-standalone/releases/download" + displayName: "Configure UV Authentication" diff --git a/eng/pipelines/templates/jobs/build-cli.yml b/eng/pipelines/templates/jobs/build-cli.yml index 7c5c72b4555..3d6a03cd846 100644 --- a/eng/pipelines/templates/jobs/build-cli.yml +++ b/eng/pipelines/templates/jobs/build-cli.yml @@ -35,6 +35,9 @@ jobs: timeoutInMinutes: 180 steps: - checkout: self + + - template: /eng/common/pipelines/templates/steps/maven-authenticate.yml + - template: /eng/pipelines/templates/steps/setup-go.yml - template: /eng/pipelines/templates/steps/set-cli-version-cd.yml diff --git a/eng/pipelines/templates/stages/build-and-test.yml b/eng/pipelines/templates/stages/build-and-test.yml index 69c777f7fab..6d860cfd059 100644 --- a/eng/pipelines/templates/stages/build-and-test.yml +++ b/eng/pipelines/templates/stages/build-and-test.yml @@ -158,6 +158,8 @@ stages: steps: - checkout: self + - template: /eng/common/pipelines/templates/steps/pypi-auth-dev-feed.yml + - template: /eng/pipelines/templates/steps/setup-go.yml - template: /eng/pipelines/templates/steps/set-cli-version-cd.yml diff --git a/eng/settings.xml b/eng/settings.xml new file mode 100644 index 00000000000..b1941716f65 --- /dev/null +++ b/eng/settings.xml @@ -0,0 +1,13 @@ + + + + azure-sdk-for-java + Azure Artifacts Maven Mirror + https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-java/maven/v1 + external:* + + + diff --git a/nuget.config b/nuget.config new file mode 100644 index 00000000000..c679a5601f0 --- /dev/null +++ b/nuget.config @@ -0,0 +1,11 @@ + + + + + + + + + + + From 2087f9b2876efe8c651845068db4602b2e088a01 Mon Sep 17 00:00:00 2001 From: Chidozie Ononiwu Date: Tue, 21 Jul 2026 19:32:16 -0700 Subject: [PATCH 4/8] remove nuget config --- eng/pipelines/templates/steps/build-msi.yml | 2 ++ nuget.config | 11 ----------- 2 files changed, 2 insertions(+), 11 deletions(-) delete mode 100644 nuget.config diff --git a/eng/pipelines/templates/steps/build-msi.yml b/eng/pipelines/templates/steps/build-msi.yml index 2db3601a7f4..f596a11f25d 100644 --- a/eng/pipelines/templates/steps/build-msi.yml +++ b/eng/pipelines/templates/steps/build-msi.yml @@ -14,6 +14,8 @@ steps: displayName: Restore NuGet packages inputs: restoreSolution: cli/installer/windows.sln + feedsToUse: select + vstsFeed: 'public/azure-sdk-for-net' - ${{ if eq(parameters.ShouldBuildForRelease, 'true') }}: - pwsh: | diff --git a/nuget.config b/nuget.config deleted file mode 100644 index c679a5601f0..00000000000 --- a/nuget.config +++ /dev/null @@ -1,11 +0,0 @@ - - - - - - - - - - - From 13da89d69aec1920526093533e7d30e89915bf19 Mon Sep 17 00:00:00 2001 From: Chidozie Ononiwu Date: Wed, 22 Jul 2026 11:23:49 -0700 Subject: [PATCH 5/8] Add repo wide nuget config --- NuGet.Config | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 NuGet.Config diff --git a/NuGet.Config b/NuGet.Config new file mode 100644 index 00000000000..c679a5601f0 --- /dev/null +++ b/NuGet.Config @@ -0,0 +1,11 @@ + + + + + + + + + + + From 31fc73dea488f5a0250f294a80ea5bae43752443 Mon Sep 17 00:00:00 2001 From: Chidozie Ononiwu Date: Wed, 22 Jul 2026 15:05:26 -0700 Subject: [PATCH 6/8] Add authentication to npm js --- eng/pipelines/templates/jobs/build-cli.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/eng/pipelines/templates/jobs/build-cli.yml b/eng/pipelines/templates/jobs/build-cli.yml index 3d6a03cd846..dcb5cd4ade0 100644 --- a/eng/pipelines/templates/jobs/build-cli.yml +++ b/eng/pipelines/templates/jobs/build-cli.yml @@ -36,6 +36,8 @@ jobs: steps: - checkout: self + - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml + - template: /eng/common/pipelines/templates/steps/maven-authenticate.yml - template: /eng/pipelines/templates/steps/setup-go.yml From b4e3d8bb12e411b384cb694d5427c6dd598666fa Mon Sep 17 00:00:00 2001 From: Chidozie Ononiwu Date: Wed, 22 Jul 2026 15:07:48 -0700 Subject: [PATCH 7/8] Update create-authenticated-npmrc.yml --- .../steps/create-authenticated-npmrc.yml | 46 +++++++++++-------- 1 file changed, 27 insertions(+), 19 deletions(-) diff --git a/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml b/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml index cb29d1312eb..3fa699b387d 100644 --- a/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml +++ b/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml @@ -1,33 +1,41 @@ parameters: - name: npmrcPath type: string + # When empty, defaults to the agent user's .npmrc ($HOME/.npmrc on + # Linux/macOS, %USERPROFILE%\.npmrc on Windows) so every subsequent + # npm / pnpm / npx call in the job inherits the registry + auth. + default: "" - name: registryUrl type: string + default: "https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-js/npm/registry/" - name: CustomCondition type: string default: succeeded() - name: ServiceConnection type: string - default: '' + default: "" steps: -- pwsh: | - Write-Host "Creating .npmrc file ${{ parameters.npmrcPath }} for registry ${{ parameters.registryUrl }}" - $parentFolder = Split-Path -Path '${{ parameters.npmrcPath }}' -Parent - - if (!(Test-Path $parentFolder)) { - Write-Host "Creating folder $parentFolder" - New-Item -Path $parentFolder -ItemType Directory | Out-Null - } + - pwsh: | + $npmrcPath = '${{ parameters.npmrcPath }}' + if (-not $npmrcPath) { $npmrcPath = Join-Path $HOME '.npmrc' } - $content = "registry=${{ parameters.registryUrl }}`n`nalways-auth=true" - $content | Out-File '${{ parameters.npmrcPath }}' - displayName: 'Create .npmrc' - condition: ${{ parameters.CustomCondition }} + Write-Host "Creating .npmrc file $npmrcPath for registry ${{ parameters.registryUrl }}" + $parentFolder = Split-Path -Path $npmrcPath -Parent -- task: npmAuthenticate@0 - displayName: Authenticate .npmrc - condition: ${{ parameters.CustomCondition }} - inputs: - workingFile: ${{ parameters.npmrcPath }} - azureDevOpsServiceConnection: ${{ parameters.ServiceConnection }} + if ($parentFolder -and -not (Test-Path $parentFolder)) { + Write-Host "Creating folder $parentFolder" + New-Item -Path $parentFolder -ItemType Directory | Out-Null + } + + "registry=${{ parameters.registryUrl }}" | Out-File $npmrcPath + Write-Host "##vso[task.setvariable variable=resolvedNpmrcPath]$npmrcPath" + displayName: "Create .npmrc" + condition: ${{ parameters.CustomCondition }} + + - task: npmAuthenticate@0 + displayName: Authenticate .npmrc + condition: ${{ parameters.CustomCondition }} + inputs: + workingFile: $(resolvedNpmrcPath) + azureDevOpsServiceConnection: ${{ parameters.ServiceConnection }} From 5906b9821fe1656f5f64803b6aac3fd937cac479 Mon Sep 17 00:00:00 2001 From: Chidozie Ononiwu Date: Thu, 23 Jul 2026 11:30:06 -0700 Subject: [PATCH 8/8] Set User Nuget.Config --- NuGet.Config | 11 ----------- eng/pipelines/templates/jobs/build-cli.yml | 14 ++++++++++++++ 2 files changed, 14 insertions(+), 11 deletions(-) delete mode 100644 NuGet.Config diff --git a/NuGet.Config b/NuGet.Config deleted file mode 100644 index c679a5601f0..00000000000 --- a/NuGet.Config +++ /dev/null @@ -1,11 +0,0 @@ - - - - - - - - - - - diff --git a/eng/pipelines/templates/jobs/build-cli.yml b/eng/pipelines/templates/jobs/build-cli.yml index dcb5cd4ade0..ab288931363 100644 --- a/eng/pipelines/templates/jobs/build-cli.yml +++ b/eng/pipelines/templates/jobs/build-cli.yml @@ -106,9 +106,21 @@ jobs: version: '9.x' displayName: Set up .NET 9 + - bash: dotnet nuget add source --name azure-sdk-for-net https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-net/nuget/v3/index.json + displayName: Add Azure SDK dev nuget feed + - bash: dotnet nuget add source --name dotnet9 https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9/nuget/v3/index.json displayName: Add internal dotnet nuget feed + - template: /eng/common/pipelines/templates/steps/pypi-auth-dev-feed.yml + parameters: + EnableTwineAuth: false + EnablePipAuth: true + EnableUvAuth: false + + - task: NuGetAuthenticate@1 + displayName: Authenticate NuGet feeds + - template: /eng/pipelines/templates/steps/configure-oidc-auth.yml - pwsh: | @@ -159,6 +171,8 @@ jobs: # Code Coverage: Generate junit report to publish results GOTESTSUM_JUNITFILE: junitTestReport.xml SYSTEM_ACCESSTOKEN: $(System.AccessToken) + PIP_INDEX_URL: $(PIP_INDEX_URL) + PIP_EXTRA_INDEX_URL: $(PIP_EXTRA_INDEX_URL) # Disable MSBuild node reuse for Aspire-related tests. # MSBuild node reuse is a pure performance optimization that is generally recommended to be disabled on CI environments # that deal with short-lived processes.