Use CFS package feed for pipeline NuGet restore (S360 3031535)#329
Conversation
Route official-build package restore through the DevDiv_PublicPackages CFS-managed mirror feed (which upstreams nuget.org) so the build never contacts api.nuget.org directly, satisfying the [SFI-ES4.2.4] Network Isolation for CFS endpoints requirement. The nuget.config lives under azure-pipelines/ (not the repo root) and is referenced explicitly via nugetConfigPath, so external clones of this public repo are unaffected and continue restoring from nuget.org without needing auth to the internal feed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5fd94a5f-353a-4ca3-a218-ecb66965d53a
There was a problem hiding this comment.
Pull request overview
Routes the official Azure Pipelines NuGet restore through the CFS-managed DevDiv_PublicPackages mirror feed (upstreaming nuget.org) to avoid direct access to api.nuget.org, aligning the pipeline with the network isolation requirement described in the PR.
Changes:
- Added a pipeline-scoped
azure-pipelines/nuget.configthat clears default sources and restores only from the CFS-managed mirror feed. - Updated the restore step in
azure-pipelines/build.ymlto explicitly use that NuGet config vianugetConfigPath.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| azure-pipelines/nuget.config | Introduces a pipeline-only NuGet source configuration pointing to the CFS-managed mirror feed. |
| azure-pipelines/build.yml | Configures the NuGetCommand@2 restore step to use the pipeline-scoped nuget.config. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
LGTM. If in the future you need access to private packages, you could create a private feed and set DevDiv_PublicPackages and the private feeds you need as it's upstreams. Not needed for now if this is enough, just mentioning in case it comes up in the future. |
Thanks, since this is open source, there won't ever be internal feeds used. |
Route official-build package restore through the DevDiv_PublicPackages CFS-managed mirror feed (which upstreams nuget.org) so the build never contacts api.nuget.org directly, satisfying the [SFI-ES4.2.4] Network Isolation for CFS endpoints requirement.
The nuget.config lives under azure-pipelines/ (not the repo root) and is referenced explicitly via nugetConfigPath, so external clones of this public repo are unaffected and continue restoring from nuget.org without needing auth to the internal feed.
Copilot-Session: 5fd94a5f-353a-4ca3-a218-ecb66965d53a