ci: route NuGet through CFS feed and drop redundant version check - #751
Open
Gavin Barron (gavinbarron) wants to merge 2 commits into
Open
ci: route NuGet through CFS feed and drop redundant version check#751Gavin Barron (gavinbarron) wants to merge 2 commits into
Gavin Barron (gavinbarron) wants to merge 2 commits into
Conversation
Routes CI package restore through the authenticated GraphDeveloperExperiences_Public Azure Artifacts feed (network isolation / CFS compliance). Requires a pipeline run to validate against the feed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9bd6fe40-0d69-4e3f-927b-8628c0ab6d34
The release pipeline triggers only on version tags (v*), so duplicate publishes cannot occur and the version-increment guard is redundant. The check also made a hardcoded Invoke-RestMethod call to api.nuget.org, tripping 1ES Network Isolation SFI policy in the build job. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 268d092b-8fa1-45ef-952d-6f56b8e3d82d
|
Vincent Biret (baywet)
approved these changes
Jul 21, 2026
Contributor
|
This pull request has conflicting changes, the author must resolve the conflicts before this pull request can be merged. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the 1ES Network Isolation SFI policy violations flagged in the release pipeline (build
227486) by keeping NuGet traffic off publicnuget.orgduring the build job.Changes
nuget.config).Validate project version has been incrementedstep and deletescripts/ValidateProjectVersionUpdated.ps1.Why drop the version check
v*), so duplicate publishes cannot occur — the guard is redundant.Invoke-RestMethodcall toapi.nuget.org. Because it bypassesnuget.config/package sources entirely, the private feed could never suppress it, and Network Isolation flagged it (processpwsh.exe/ taskPowerShell/ hostapi.nuget.org) in the build job.Note
The deploy job's push to public
nuget.orgis the intended external publish and is out of scope here.