From fab1e5b5ae65411d277fe4599fa0c1daadbf0ab3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Aug 2026 02:54:03 +0000
Subject: [PATCH 1/5] Enforce CFSClean network isolation

Co-authored-by: mikeharder <9459391+mikeharder@users.noreply.github.com>
---
 azure-pipelines/1es-redirect.yml |  1 +
 azure-pipelines/common-build.yml | 12 ++++++++++++
 2 files changed, 13 insertions(+)

diff --git a/azure-pipelines/1es-redirect.yml b/azure-pipelines/1es-redirect.yml
index 00e3189db..960f06715 100644
--- a/azure-pipelines/1es-redirect.yml
+++ b/azure-pipelines/1es-redirect.yml
@@ -25,6 +25,7 @@ extends:
   parameters:
     settings:
       skipBuildTagsForGitHubPullRequests: true
+      networkIsolationPolicy: Permissive, CFSClean
     sdl:
       git:
         longpaths: true
diff --git a/azure-pipelines/common-build.yml b/azure-pipelines/common-build.yml
index 195585fa8..8252144ae 100644
--- a/azure-pipelines/common-build.yml
+++ b/azure-pipelines/common-build.yml
@@ -9,8 +9,20 @@ steps:
       versionSpec: '${{ parameters.NodeVersion }}'
     displayName: 'Install Node.js ${{ parameters.NodeVersion }}'
 
+  - pwsh: |
+      "registry=https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-js/npm/registry/" |
+        Out-File "$(Agent.TempDirectory)/aoav.npmrc"
+    displayName: 'Create npm config'
+
+  - task: npmAuthenticate@0
+    inputs:
+      workingFile: '$(Agent.TempDirectory)/aoav.npmrc'
+    displayName: 'Authenticate npm config'
+
   - script: 'node common/scripts/install-run-rush.js install'
     displayName: 'rush install'
+    env:
+      NPM_CONFIG_USERCONFIG: '$(Agent.TempDirectory)/aoav.npmrc'
 
   - script: 'node common/scripts/install-run-rush.js rebuild --verbose'
     displayName: 'rush build'
\ No newline at end of file

From a248ef200fd62793cb43df12cb3a12d976c42d12 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Aug 2026 03:42:00 +0000
Subject: [PATCH 2/5] Port authenticated npmrc template

Co-authored-by: mikeharder <9459391+mikeharder@users.noreply.github.com>
---
 azure-pipelines/common-build.yml              | 12 ++----
 .../steps/create-authenticated-npmrc.yml      | 41 +++++++++++++++++++
 2 files changed, 44 insertions(+), 9 deletions(-)
 create mode 100644 eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml

diff --git a/azure-pipelines/common-build.yml b/azure-pipelines/common-build.yml
index 8252144ae..a25c5a1a5 100644
--- a/azure-pipelines/common-build.yml
+++ b/azure-pipelines/common-build.yml
@@ -9,15 +9,9 @@ steps:
       versionSpec: '${{ parameters.NodeVersion }}'
     displayName: 'Install Node.js ${{ parameters.NodeVersion }}'
 
-  - pwsh: |
-      "registry=https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-js/npm/registry/" |
-        Out-File "$(Agent.TempDirectory)/aoav.npmrc"
-    displayName: 'Create npm config'
-
-  - task: npmAuthenticate@0
-    inputs:
-      workingFile: '$(Agent.TempDirectory)/aoav.npmrc'
-    displayName: 'Authenticate npm config'
+  - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+    parameters:
+      npmrcPath: $(Agent.TempDirectory)/aoav.npmrc
 
   - script: 'node common/scripts/install-run-rush.js install'
     displayName: 'rush install'
diff --git a/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml b/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
new file mode 100644
index 000000000..3fa699b38
--- /dev/null
+++ b/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
@@ -0,0 +1,41 @@
+parameters:
+  - name: npmrcPath
+    type: string
+    # When empty, defaults to the agent user's .npmrc ($HOME/.npmrc on
+    # Linux/macOS, %USERPROFILE%\.npmrc on Windows) so every subsequent
+    # npm / pnpm / npx call in the job inherits the registry + auth.
+    default: ""
+  - name: registryUrl
+    type: string
+    default: "https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-js/npm/registry/"
+  - name: CustomCondition
+    type: string
+    default: succeeded()
+  - name: ServiceConnection
+    type: string
+    default: ""
+
+steps:
+  - pwsh: |
+      $npmrcPath = '${{ parameters.npmrcPath }}'
+      if (-not $npmrcPath) { $npmrcPath = Join-Path $HOME '.npmrc' }
+
+      Write-Host "Creating .npmrc file $npmrcPath for registry ${{ parameters.registryUrl }}"
+      $parentFolder = Split-Path -Path $npmrcPath -Parent
+
+      if ($parentFolder -and -not (Test-Path $parentFolder)) {
+        Write-Host "Creating folder $parentFolder"
+        New-Item -Path $parentFolder -ItemType Directory | Out-Null
+      }
+
+      "registry=${{ parameters.registryUrl }}" | Out-File $npmrcPath
+      Write-Host "##vso[task.setvariable variable=resolvedNpmrcPath]$npmrcPath"
+    displayName: "Create .npmrc"
+    condition: ${{ parameters.CustomCondition }}
+
+  - task: npmAuthenticate@0
+    displayName: Authenticate .npmrc
+    condition: ${{ parameters.CustomCondition }}
+    inputs:
+      workingFile: $(resolvedNpmrcPath)
+      azureDevOpsServiceConnection: ${{ parameters.ServiceConnection }}

From 7d506744040262b26cc77fda2ac5b589c9eaedfe Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Aug 2026 04:05:39 +0000
Subject: [PATCH 3/5] Route AutoRest tests through package feed proxy

Co-authored-by: mikeharder <9459391+mikeharder@users.noreply.github.com>
---
 .azure-pipelines.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.azure-pipelines.yml b/.azure-pipelines.yml
index 01bb29d8f..4b5d13410 100644
--- a/.azure-pipelines.yml
+++ b/.azure-pipelines.yml
@@ -28,6 +28,9 @@ extends:
 
               - script: 'node common/scripts/install-run-rush.js test'
                 displayName: 'rush test'
+                env:
+                  NPM_CONFIG_USERCONFIG: '$(Agent.TempDirectory)/aoav.npmrc'
+                  autorest_registry: 'https://packagefeedproxy.microsoft.io/npm/'
 
               - script: 'node common/scripts/install-run-rush.js regen-ruleindex'
                 displayName: 'rush regen-ruleindex'

From e8c1fa4042def1a459284c52b6cb0a225b6c057f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 6 Aug 2026 00:27:36 +0000
Subject: [PATCH 4/5] Install pinned pnpm through authenticated feed

Co-authored-by: mikeharder <9459391+mikeharder@users.noreply.github.com>
---
 azure-pipelines/common-build.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/azure-pipelines/common-build.yml b/azure-pipelines/common-build.yml
index a25c5a1a5..6c6e0d643 100644
--- a/azure-pipelines/common-build.yml
+++ b/azure-pipelines/common-build.yml
@@ -13,6 +13,13 @@ steps:
     parameters:
       npmrcPath: $(Agent.TempDirectory)/aoav.npmrc
 
+  - pwsh: |
+      $rushJson = Get-Content -Raw "$(Build.SourcesDirectory)/rush.json" | ConvertFrom-Json
+      npm install -g "pnpm@$($rushJson.pnpmVersion)"
+    displayName: 'Install pnpm'
+    env:
+      NPM_CONFIG_USERCONFIG: '$(Agent.TempDirectory)/aoav.npmrc'
+
   - script: 'node common/scripts/install-run-rush.js install'
     displayName: 'rush install'
     env:

From 14526cd9319b51f2c292347414ba83438d4932c0 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Mon, 10 Aug 2026 12:30:07 -0700
Subject: [PATCH 5/5] write to common/config/rush/.npmrc

---
 .azure-pipelines.yml             |  3 +--
 azure-pipelines/common-build.yml | 11 +----------
 2 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/.azure-pipelines.yml b/.azure-pipelines.yml
index 4b5d13410..8f4b08bd7 100644
--- a/.azure-pipelines.yml
+++ b/.azure-pipelines.yml
@@ -29,8 +29,7 @@ extends:
               - script: 'node common/scripts/install-run-rush.js test'
                 displayName: 'rush test'
                 env:
-                  NPM_CONFIG_USERCONFIG: '$(Agent.TempDirectory)/aoav.npmrc'
-                  autorest_registry: 'https://packagefeedproxy.microsoft.io/npm/'
+                  autorest_registry: 'https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-js/npm/registry/'
 
               - script: 'node common/scripts/install-run-rush.js regen-ruleindex'
                 displayName: 'rush regen-ruleindex'
diff --git a/azure-pipelines/common-build.yml b/azure-pipelines/common-build.yml
index 6c6e0d643..45e1ac2ab 100644
--- a/azure-pipelines/common-build.yml
+++ b/azure-pipelines/common-build.yml
@@ -11,19 +11,10 @@ steps:
 
   - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
     parameters:
-      npmrcPath: $(Agent.TempDirectory)/aoav.npmrc
-
-  - pwsh: |
-      $rushJson = Get-Content -Raw "$(Build.SourcesDirectory)/rush.json" | ConvertFrom-Json
-      npm install -g "pnpm@$($rushJson.pnpmVersion)"
-    displayName: 'Install pnpm'
-    env:
-      NPM_CONFIG_USERCONFIG: '$(Agent.TempDirectory)/aoav.npmrc'
+      npmrcPath: $(Build.SourcesDirectory)/common/config/rush/.npmrc
 
   - script: 'node common/scripts/install-run-rush.js install'
     displayName: 'rush install'
-    env:
-      NPM_CONFIG_USERCONFIG: '$(Agent.TempDirectory)/aoav.npmrc'
 
   - script: 'node common/scripts/install-run-rush.js rebuild --verbose'
     displayName: 'rush build'
\ No newline at end of file