Add CFSClean enforcement

cli/azd/extensions/microsoft.azd.demo/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Release History
 
+## 0.7.2 (2026-07-16)
+
+- Simple test release of extension, with no changes.
+
 ## 0.7.1 (2026-07-14)
 
 - Simple test release of extension, with no changes.

cli/azd/extensions/microsoft.azd.demo/extension.yaml

@@ -4,7 +4,7 @@ namespace: demo
 displayName: Demo Extension
 description: This extension provides examples of the azd extension framework.
 usage: azd demo <command> [options]
-version: 0.7.1
+version: 0.7.2
 language: go
 capabilities:
   - custom-commands

cli/azd/extensions/microsoft.azd.demo/version.txt

@@ -1 +1 @@
-0.7.1
+0.7.2

eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml

@@ -1,33 +1,41 @@
 parameters:
   - name: npmrcPath
     type: string
+    # When empty, defaults to the agent user's .npmrc ($HOME/.npmrc on
+    # Linux/macOS, %USERPROFILE%\.npmrc on Windows) so every subsequent
+    # npm / pnpm / npx call in the job inherits the registry + auth.
+    default: ""
   - name: registryUrl
     type: string
+    default: "https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-js/npm/registry/"
   - name: CustomCondition
     type: string
     default: succeeded()
   - name: ServiceConnection
     type: string
-    default: ''
+    default: ""
 
 steps:
-- pwsh: |
-    Write-Host "Creating .npmrc file ${{ parameters.npmrcPath }} for registry ${{ parameters.registryUrl }}"
-    $parentFolder = Split-Path -Path '${{ parameters.npmrcPath }}' -Parent
-
-    if (!(Test-Path $parentFolder)) {
-      Write-Host "Creating folder $parentFolder"
-      New-Item -Path $parentFolder -ItemType Directory | Out-Null
-    }
+  - pwsh: |
+      $npmrcPath = '${{ parameters.npmrcPath }}'
+      if (-not $npmrcPath) { $npmrcPath = Join-Path $HOME '.npmrc' }
 
-    $content = "registry=${{ parameters.registryUrl }}`n`nalways-auth=true"
-    $content | Out-File '${{ parameters.npmrcPath }}'
-  displayName: 'Create .npmrc'
-  condition: ${{ parameters.CustomCondition }}
+      Write-Host "Creating .npmrc file $npmrcPath for registry ${{ parameters.registryUrl }}"
+      $parentFolder = Split-Path -Path $npmrcPath -Parent
 
-- task: npmAuthenticate@0
-  displayName: Authenticate .npmrc
-  condition: ${{ parameters.CustomCondition }}
-  inputs:
-    workingFile: ${{ parameters.npmrcPath }}
-    azureDevOpsServiceConnection: ${{ parameters.ServiceConnection }}
+      if ($parentFolder -and -not (Test-Path $parentFolder)) {
+        Write-Host "Creating folder $parentFolder"
+        New-Item -Path $parentFolder -ItemType Directory | Out-Null
+      }
+
+      "registry=${{ parameters.registryUrl }}" | Out-File $npmrcPath
+      Write-Host "##vso[task.setvariable variable=resolvedNpmrcPath]$npmrcPath"
+    displayName: "Create .npmrc"
+    condition: ${{ parameters.CustomCondition }}
+
+  - task: npmAuthenticate@0
+    displayName: Authenticate .npmrc
+    condition: ${{ parameters.CustomCondition }}
+    inputs:
+      workingFile: $(resolvedNpmrcPath)
+      azureDevOpsServiceConnection: ${{ parameters.ServiceConnection }}

eng/common/pipelines/templates/steps/maven-authenticate.yml

@@ -0,0 +1,17 @@
+parameters:
+  SourceDirectory: $(Build.SourcesDirectory)
+
+steps:
+  # Copy mirror settings to default Maven location so all requests go through CFS
+  - pwsh: |
+      $m2Dir = if ($env:USERPROFILE) { "$env:USERPROFILE\.m2" } else { "$HOME/.m2" }
+      New-Item -ItemType Directory -Force -Path $m2Dir | Out-Null
+      Copy-Item -Path "${{ parameters.SourceDirectory }}/eng/settings.xml" -Destination "$m2Dir/settings.xml"
+    displayName: "Setup Maven mirror settings"
+
+  # Authenticate with Azure Artifacts feeds
+  # MavenAuthenticate adds <server> entries to ~/.m2/settings.xml matching mirror id 'azure-sdk-for-java'
+  - task: MavenAuthenticate@0
+    displayName: "Maven Authenticate"
+    inputs:
+      artifactsFeeds: "azure-sdk-for-java"

eng/common/pipelines/templates/steps/pypi-auth-dev-feed.yml

@@ -0,0 +1,49 @@
+parameters:
+  DevFeedName: "public/azure-sdk-for-python"
+  EnableTwineAuth: true
+  EnablePipAuth: true
+  EnableUvAuth: true
+
+steps:
+  - pwsh: |
+      # For safety default to publishing to the private feed.
+      # Publish to https://dev.azure.com/azure-sdk/internal/_packaging?_a=feed&feed=azure-sdk-for-python-pr
+      $devopsFeedName = 'internal/azure-sdk-for-python-pr'
+      if (-not ('$(Build.Repository.Name)').EndsWith('-pr')) {
+        # Publish to https://dev.azure.com/azure-sdk/public/_packaging?_a=feed&feed=azure-sdk-for-python
+        $devopsFeedName = '${{ parameters.DevFeedName }}'
+      }
+      echo "##vso[task.setvariable variable=DevFeedName]$devopsFeedName"
+      echo "Using DevopsFeed = $devopsFeedName"
+    displayName: Setup DevOpsFeedName
+
+  - ${{ if eq(parameters.EnableTwineAuth, true) }}:
+      - task: TwineAuthenticate@0
+        displayName: "Twine Authenticate to feed"
+        inputs:
+          artifactFeeds: $(DevFeedName)
+
+  - ${{ if eq(parameters.EnablePipAuth, true) }}:
+      - task: PipAuthenticate@1
+        displayName: "Pip Authenticate to feed"
+        inputs:
+          artifactFeeds: $(DevFeedName)
+          onlyAddExtraIndex: false
+
+  - ${{ if eq(parameters.EnableUvAuth, true) }}:
+      - pwsh: |
+          if ($env:PIP_INDEX_URL) {
+            Write-Host "Found pip index URL: $($env:PIP_INDEX_URL)"
+            # UV_DEFAULT_INDEX is the canonical replacement for the deprecated UV_INDEX_URL (uv 0.4.23+).
+            # PIP_INDEX_URL is set by PipAuthenticate@1 and contains embedded credentials, which uv
+            # will use for Basic auth against the ADO feed (and its PyPI upstream) per astral-sh/uv#12651.
+            Write-Host "##vso[task.setvariable variable=UV_DEFAULT_INDEX]$($env:PIP_INDEX_URL)"
+            # Disable keyring so uv uses the URL-embedded credentials directly.
+            Write-Host "##vso[task.setvariable variable=UV_KEYRING_PROVIDER]disabled"
+          } else {
+            Write-Host "##[warning]PIP_INDEX_URL not set - uv will fall back to public PyPI."
+          }
+          # Force any managed Python downloads to go directly to GitHub releases
+          # rather than the default CDN (releases.astral.sh).
+          Write-Host "##vso[task.setvariable variable=UV_PYTHON_INSTALL_MIRROR]https://github.com/astral-sh/python-build-standalone/releases/download"
+        displayName: "Configure UV Authentication"

eng/pipelines/templates/jobs/build-cli.yml

@@ -35,6 +35,11 @@ jobs:
     timeoutInMinutes: 180
     steps:
       - checkout: self
+
+      - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+
+      - template: /eng/common/pipelines/templates/steps/maven-authenticate.yml
+
       - template: /eng/pipelines/templates/steps/setup-go.yml
 
       - template: /eng/pipelines/templates/steps/set-cli-version-cd.yml
@@ -101,9 +106,21 @@ jobs:
           version: '9.x'
         displayName: Set up .NET 9
 
+      - bash: dotnet nuget add source --name azure-sdk-for-net https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-net/nuget/v3/index.json
+        displayName: Add Azure SDK dev nuget feed
+
       - bash: dotnet nuget add source --name dotnet9 https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9/nuget/v3/index.json
         displayName: Add internal dotnet nuget feed
 
+      - template: /eng/common/pipelines/templates/steps/pypi-auth-dev-feed.yml
+        parameters:
+          EnableTwineAuth: false
+          EnablePipAuth: true
+          EnableUvAuth: false
+
+      - task: NuGetAuthenticate@1
+        displayName: Authenticate NuGet feeds
+
       - template: /eng/pipelines/templates/steps/configure-oidc-auth.yml
 
       - pwsh: |
@@ -154,6 +171,8 @@ jobs:
           # Code Coverage: Generate junit report to publish results
           GOTESTSUM_JUNITFILE: junitTestReport.xml
           SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+          PIP_INDEX_URL: $(PIP_INDEX_URL)
+          PIP_EXTRA_INDEX_URL: $(PIP_EXTRA_INDEX_URL)
           # Disable MSBuild node reuse for Aspire-related tests.
           # MSBuild node reuse is a pure performance optimization that is generally recommended to be disabled on CI environments
           # that deal with short-lived processes.

eng/pipelines/templates/stages/1es-redirect.yml

@@ -32,7 +32,7 @@ extends:
           enabled: true
     settings:
       skipBuildTagsForGitHubPullRequests: true
-      networkIsolationPolicy: Permissive
+      networkIsolationPolicy: Permissive, CFSClean
     sdl:
       # Turn off the build warnings caused by disabling some sdl checks
       createAdoIssuesForJustificationsForDisablement: false

eng/pipelines/templates/stages/build-and-test.yml

@@ -158,6 +158,8 @@ stages:
         steps:
           - checkout: self
 
+          - template: /eng/common/pipelines/templates/steps/pypi-auth-dev-feed.yml
+
           - template: /eng/pipelines/templates/steps/setup-go.yml
 
           - template: /eng/pipelines/templates/steps/set-cli-version-cd.yml

eng/pipelines/templates/steps/build-msi.yml

@@ -14,6 +14,8 @@ steps:
     displayName: Restore NuGet packages
     inputs:
       restoreSolution: cli/installer/windows.sln
+      feedsToUse: select
+      vstsFeed: 'public/azure-sdk-for-net'
 
   - ${{ if eq(parameters.ShouldBuildForRelease, 'true') }}:
     - pwsh: |

eng/settings.xml

@@ -0,0 +1,13 @@
+<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
+                        https://maven.apache.org/xsd/settings-1.0.0.xsd">
+  <mirrors>
+    <mirror>
+      <id>azure-sdk-for-java</id>
+      <name>Azure Artifacts Maven Mirror</name>
+      <url>https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-java/maven/v1</url>
+      <mirrorOf>external:*</mirrorOf>
+    </mirror>
+  </mirrors>
+</settings>