[s360-breeze-toolkit: SFI-ES-4.2.4] Use internal npm feed in Azure Pipelines by azchohfi · Pull Request #715 · microsoft/winappCli

Alexandre Zollinger Chohfi (azchohfi) · 2026-08-05T20:53:16Z

Summary - enable the `Permissive,CFSClean` network-isolation policy for the release pipeline - authenticate an ADO-only npm configuration against the `pde-oss_Internal` Azure Artifacts feed - move the pipeline-only npm config to a root `.npmrc` during ADO execution and authenticate it before the build - preserve public npm defaults for external contributors and local builds ## Why The project is open source, so a default clone must restore from public feeds without Microsoft credentials. The private feed configuration is stored as `.pipelines/release-npmrc` and moved to the repository-root `.npmrc` only by Azure Pipelines, matching the existing NuGet pattern. Source manifests, lockfiles, scripts, and developer npm configuration remain unchanged. ## Validation - fresh-config `npm ci --ignore-scripts --no-audit --no-fund` completed using `registry.npmjs.org` - the pipeline-only npm configuration resolves to the authenticated Azure Artifacts registry - both modified pipeline YAML files parse successfully - the generated four-file patch applies cleanly to the original base commit

S360-Run-Id: a40e6fea-b1de-4ded-b44a-af6bcd7b7bdb S360-KPI: SFI-ES-4.2.4 S360-Skill: sfi-es424-central-feed-services S360-Arm: dedicated_skill S360-Action-Items: 0f27291c-bc52-49fa-a978-7b4a9c362107:47a034ea-dc7f-4eee-8a18-567a05a98c1f Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0b1d2a96-1af9-41af-aa4e-dd385a363450

Keep local and external contributor builds on the public npm registry while authenticating ADO builds against the internal upstream feed. S360-Run-Id: a40e6fea-b1de-4ded-b44a-af6bcd7b7bdb S360-KPI: SFI-ES-4.2.4 S360-Skill: sfi-es424-central-feed-services S360-Arm: dedicated_skill S360-Action-Items: 0f27291c-bc52-49fa-a978-7b4a9c362107:47a034ea-dc7f-4eee-8a18-567a05a98c1f Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0b1d2a96-1af9-41af-aa4e-dd385a363450

Alexandre Zollinger Chohfi (azchohfi) · 2026-08-05T20:56:21Z

[AI-Native] PR Code Quality Assessment

Quality: 🟢A
Effort to Merge: 🟢 Low
Skill/Agent: sfi-es424-central-feed-services | KPI: ES-4.2.4 (Central Feed Services)

Code Quality

What's done well:

Keeps public package feeds as the default for open-source contributors while creating private-feed overrides only inside Azure Pipelines.
Mirrors the existing NuGet pattern: move a pipeline-only config to the repository root, authenticate it, then run the unchanged build template.
Places both authentication tasks before package access, so npm and implicit NuGet restores are authenticated before the build.
Preserves Permissive while appending CFSClean, matching the required network-isolation sequencing.

Human decisions required:

Confirm pde-oss_Internal has the required npm and NuGet upstream sources and grants the pipeline build identity read access.
Confirm the first release run restores both ecosystems successfully, then inspect Stop Network Isolation for remaining audited public-feed connections.

Potential Issues

#	Issue	Severity	Risk
1	Feed upstream configuration and build-service permissions cannot be proven from the repository diff.	🟢 Human	The first ADO run may expose an authorization or missing-upstream configuration issue.

Recommendations

Run pipeline 182109 and verify npm plus NuGet restore behavior before merging.
After merge, complete three clean runs over at least seven days so the S360 action can resolve.

Assessment performed by generic-pr-quality-evaluator-github-skill | 2026-08-05T21:00:00Z

Copilot

Pull request overview

Configures Azure Pipelines to restore npm dependencies through the authenticated internal CFS feed while preserving public defaults elsewhere.

Changes:

Adds the pipeline-only internal npm configuration.
Authenticates and passes it to both npm build steps.
Enables the release pipeline’s required network policy.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
`.pipelines/internal-npmrc`	Defines the internal Azure Artifacts registry.
`.pipelines/templates/build.yaml`	Passes the npm configuration to npm-consuming tasks.
`.pipelines/ci.yml`	Authenticates the feed for CI builds.
`.pipelines/release.yml`	Adds feed authentication and the network policy.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Move the pipeline-only npm feed config to a root .npmrc before authentication so npmAuthenticate@0 accepts it and npm discovers it naturally. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0b1d2a96-1af9-41af-aa4e-dd385a363450

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

github-actions · 2026-08-05T21:21:40Z

⏳ Build in progress — metrics below are from a previous commit and will update when the current build finishes.

Build Metrics Report

Binary Sizes

Artifact	Baseline	Current	Delta
CLI (ARM64)	37.59 MB	37.59 MB	✅ 0.0 KB (0.00%)
CLI (x64)	37.75 MB	37.75 MB	✅ 0.0 KB (0.00%)
MSIX (ARM64)	15.61 MB	15.61 MB	📈 +0.0 KB (+0.00%)
MSIX (x64)	16.59 MB	16.59 MB	📉 -0.2 KB (-0.00%)
NPM Package	32.57 MB	32.57 MB	📉 -0.2 KB (-0.00%)
NuGet Package	32.62 MB	32.62 MB	📈 +0.0 KB (+0.00%)

Test Results

✅ 4218 passed, 5 skipped out of 4223 tests in 547.0s (-102.8s vs. baseline)

Test Coverage

✅ 93% line coverage, 87.2% branch coverage · ✅ no change vs. baseline

CLI Startup Time

50ms median (x64, winapp --version) · ✅ -8ms vs. baseline

Try This Build

Installs the MSIX for your architecture, replacing any previously installed build. Needs the GitHub CLI — the command offers to install it and sign you in if it is missing.

& ([scriptblock]::Create((irm https://raw.githubusercontent.com/microsoft/winappCli/main/scripts/winapp-pr.ps1))) 715

Switching between builds often?

Put the tool on your PATH once:

& ([scriptblock]::Create((irm https://raw.githubusercontent.com/microsoft/winappCli/main/scripts/winapp-pr.ps1))) -AddToPath

Then this build is just:

winapp-pr 715

Run winapp-pr with no arguments to pick from a list of open PRs.

Updated 2026-08-05 21:21:40 UTC · commit ccbc426 · workflow run

Apply the CFS endpoint policy to the PR validation pipeline so remaining public feed access fails before the release pipeline. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0b1d2a96-1af9-41af-aa4e-dd385a363450

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0b1d2a96-1af9-41af-aa4e-dd385a363450

Alexandre Zollinger Chohfi (azchohfi) and others added 2 commits August 5, 2026 11:47

Copilot AI balanced review requested due to automatic review settings August 5, 2026 20:53

Copilot started reviewing on behalf of Alexandre Zollinger Chohfi (azchohfi) August 5, 2026 20:53 View session

Alexandre Zollinger Chohfi (azchohfi) added s360-toolkit Service 360 remediation SFI:ES-4.2.4 Service 360 remediation labels Aug 5, 2026

Copilot AI reviewed Aug 5, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 5, 2026 21:01

Copilot started reviewing on behalf of Alexandre Zollinger Chohfi (azchohfi) August 5, 2026 21:02 View session

Copilot AI reviewed Aug 5, 2026

View reviewed changes

Comment thread .pipelines/ci.yml

Comment thread .pipelines/release.yml

Alexandre Zollinger Chohfi (azchohfi) added 4 commits August 6, 2026 11:38

Enforce CFSClean in CI

49c27d3

Apply the CFS endpoint policy to the PR validation pipeline so remaining public feed access fails before the release pipeline. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0b1d2a96-1af9-41af-aa4e-dd385a363450

Route isolated test traffic through internal feeds

02261fd

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0b1d2a96-1af9-41af-aa4e-dd385a363450

Use configured feed in NuGet integration tests

c932933

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0b1d2a96-1af9-41af-aa4e-dd385a363450

Route MSIX packaging through internal feed

b77e334

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0b1d2a96-1af9-41af-aa4e-dd385a363450

Alexandre Zollinger Chohfi (azchohfi) merged commit 23ec6d3 into main Aug 7, 2026
7 checks passed

Alexandre Zollinger Chohfi (azchohfi) deleted the sfi/es-4.2.4/a40e6fea branch August 7, 2026 17:22

This was referenced Aug 14, 2026

Bump the dotnet-dependencies group with 5 updates rhamenator/SimpleLoanCalculator#3

Open

Bump Microsoft.Windows.SDK.BuildTools.WinApp from 0.3.1 to 0.6.0 Has-X/Registry#14

Open

Alexandre Zollinger Chohfi (azchohfi) mentioned this pull request Aug 17, 2026

Re-land the NuGet-client migration on stable NuGet 7.9.0 #761

Open

4 tasks

Navigation Menu

Uh oh!

[s360-breeze-toolkit: SFI-ES-4.2.4] Use internal npm feed in Azure Pipelines - #715

[s360-breeze-toolkit: SFI-ES-4.2.4] Use internal npm feed in Azure Pipelines#715
Alexandre Zollinger Chohfi (azchohfi) merged 7 commits into
mainfrom
sfi/es-4.2.4/a40e6fea

Alexandre Zollinger Chohfi (azchohfi) commented Aug 5, 2026 •

edited

Loading

Uh oh!

Alexandre Zollinger Chohfi (azchohfi) commented Aug 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Alexandre Zollinger Chohfi (azchohfi) commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Alexandre Zollinger Chohfi (azchohfi) commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

[AI-Native] PR Code Quality Assessment

Code Quality

Potential Issues

Recommendations

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Build Metrics Report

Binary Sizes

Test Results

Test Coverage

CLI Startup Time

Try This Build

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Alexandre Zollinger Chohfi (azchohfi) commented Aug 5, 2026 •

edited

Loading

Alexandre Zollinger Chohfi (azchohfi) commented Aug 5, 2026 •

edited

Loading

github-actions Bot commented Aug 5, 2026 •

edited

Loading