Force autorest cache pre-population onto the private npm feed (CFSClean) - #3697
Merged
Ramses Sanchez-Hernandez (ramsessanchez) merged 1 commit intoAug 6, 2026
Conversation
PrePopulateAutorestCache.ps1 runs 'npm install <ext> --prefix <dir>' for @autorest/core and @autorest/modelerfour. With --prefix, npm did not honor the registry/auth in ~/.npmrc and reached registry.npmjs.org directly (2 hits/build) - the residual CFSClean violation on pipeline 187 after the autorest --skip-upgrade-check fix (#3696). Pass --userconfig and --registry explicitly (read from the authenticated ~/.npmrc that install-tools.yml produced) so both installs use the PowerShell_V2_Build private feed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188
Ramses Sanchez-Hernandez (ramsessanchez)
approved these changes
Aug 6, 2026
Ramses Sanchez-Hernandez (ramsessanchez)
merged commit Aug 6, 2026
e29ebec
into
main
4 of 7 checks passed
Ramses Sanchez-Hernandez (ramsessanchez)
deleted the
gavinbarron/cfs-prepopulate-registry
branch
August 6, 2026 23:50
Ramses Sanchez-Hernandez (ramsessanchez)
pushed a commit
that referenced
this pull request
Aug 7, 2026
…-install (CFSClean) (#3703) PR #3696/#3697 routed the autorest and Rush package registry to the private CFS feed, but pipeline 187 still showed 2 registry.npmjs.org hits during 'Rush Build'. Root cause: 'rush install' self-installs Rush and pnpm via 'npm install', and each runs 'npm audit', which POSTs to the public registry.npmjs.org audit endpoint (the private Azure Artifacts feed does not serve it) - 2 self-installs = 2 npmjs hits. Adding audit=false (and fund=false) to the .npmrc content written by Configure-PrivateNpmFeed.ps1 propagates through Rush's .npmrc transforms to those self-install npm calls, eliminating the egress. Verified via build 231003 log + network-isolation telemetry (hits during the Rush Build window, node.exe). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fixes the residual CFSClean network-isolation violation on the PowerShell pipelines (187/221/663): 2
registry.npmjs.orgrequests per build that remained after the autorest--skip-upgrade-checkfix (#3696).Root cause
Traced from build telemetry + task logs: the 2 hits come from the "Pre-populate autorest extension cache" task.
PrePopulateAutorestCache.ps1runs:With
--prefix, npm did not honor the registry/auth in the authenticated~/.npmrc(produced byinstall-tools.yml) and reachedregistry.npmjs.orgdirectly — eachnpm install= 1 hit, 2 total. The task meant to prevent autorest's npm calls was itself the leak.Change (
tools/Utilities/PrePopulateAutorestCache.ps1)Derive
--userconfigand--registryfrom the authenticated~/.npmrcand pass them explicitly to eachnpm install, so both installs use thePowerShell_V2_Buildprivate feed (no hard-coded URL). Warn if~/.npmrcis missing.Notes
registry.npmjs.orgCFSClean egress for 187/221/663.mainpost-merge to confirm zeroregistry.npmjs.orghits.Relates to S360 KPI 527fb616-07aa-8198-6419-50d04ef1c2f3 (1ES network isolation).