Use authenticated package feeds in packaging pipelines - #32005
Merged
Conversation
Route package restores through authenticated feeds and remove redundant public package bootstrap steps. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d78d7b1-43f9-4fe3-972f-3a70b59db4f6
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Azure Pipelines packaging workflows to ensure dependency restores and lockfile-based downloads use authenticated Azure Artifacts feeds, improving compatibility with network-isolated build agents and reducing unwanted access to public registries.
Changes:
- Add npm configuration to ensure registry host replacement is enforced for lockfile/resolved URL scenarios.
- Generate a single internal-feed-only NuGet config and apply it to both repo-root
NuGet.configandcsharp/NuGet.CSharp.config. - Simplify/adjust packaging pipelines: remove bootstrap steps (Az module install, NuGetToolInstaller in DML template), move feed setup earlier, and skip component governance detection in artifact-only jobs.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tools/ci_build/github/azure-pipelines/templates/setup-feeds-and-python-steps.yml | Tightens npm behavior and ensures C# restores use the same internal-feed-only NuGet configuration. |
| tools/ci_build/github/azure-pipelines/templates/publish-symbolrequestprod-api.yml | Removes PowerShell module bootstrap step that could hit external sources. |
| tools/ci_build/github/azure-pipelines/templates/c-api-cpu.yml | Runs authenticated feed setup earlier in the job so restores/builds are constrained to configured sources. |
| tools/ci_build/github/azure-pipelines/stages/nuget-win-cuda-packaging-stage.yml | Skips component governance detection for packaging job. |
| tools/ci_build/github/azure-pipelines/nuget/templates/dml-vs-2022.yml | Removes NuGetToolInstaller step to avoid unnecessary external contact. |
| tools/ci_build/github/azure-pipelines/npm-packaging-pipeline.yml | Skips component governance detection for artifact-only download/publish job. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Use the CUDA_MODULE_LOADING environment variable recognized by CUDA. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d78d7b1-43f9-4fe3-972f-3a70b59db4f6
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.
Suppressed comments (2)
tools/ci_build/github/azure-pipelines/templates/setup-feeds-and-python-steps.yml:246
- Same encoding issue as
NuGet.config: overwritingcsharp/NuGet.CSharp.configwithout an explicit-Encodingcan produce a file whose actual encoding doesn’t match theutf-8XML declaration, potentially breakingdotnet/msbuild restorethat relies on this config.
Set-Content -Path $csharpNugetConfigPath -Value $nugetConfig
tools/ci_build/github/azure-pipelines/templates/setup-feeds-and-python-steps.yml:241
$nugetConfigdeclaresencoding="utf-8", butSet-Contentwithout-Encodinguses Windows PowerShell’s default encoding on Windows agents. That can write a non-UTF-8NuGet.config, which may cause NuGet/XML parsing failures or inconsistent behavior across agents. Please write the file with an explicit UTF-8 encoding to match the XML declaration.
This issue also appears on line 246 of the same file.
Set-Content -Path "NuGet.config" -Value $nugetConfig
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3434ce2e-83c3-4560-a518-f8c54dec8e5f
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3434ce2e-83c3-4560-a518-f8c54dec8e5f
Tianlei Wu (tianleiwu)
approved these changes
Aug 13, 2026
This was referenced Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Motivation and Context
These changes keep packaging workflows compatible with network-isolated build agents and prevent package tools from bypassing the configured authenticated sources.
Validation