Disable npm audit to stop registry.npmjs.org egress in Rush self-install (CFSClean) - #3703
Merged
Ramses Sanchez-Hernandez (ramsessanchez) merged 1 commit intoAug 7, 2026
Conversation
…-install (CFSClean) PR #3696/#3697 routed the autorest and Rush package registry to the private CFS feed, but pipeline 187 still showed 2 registry.npmjs.org hits during 'Rush Build'. Root cause: 'rush install' self-installs Rush and pnpm via 'npm install', and each runs 'npm audit', which POSTs to the public registry.npmjs.org audit endpoint (the private Azure Artifacts feed does not serve it) - 2 self-installs = 2 npmjs hits. Adding audit=false (and fund=false) to the .npmrc content written by Configure-PrivateNpmFeed.ps1 propagates through Rush's .npmrc transforms to those self-install npm calls, eliminating the egress. Verified via build 231003 log + network-isolation telemetry (hits during the Rush Build window, node.exe). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188
Ramses Sanchez-Hernandez (ramsessanchez)
approved these changes
Aug 7, 2026
Ramses Sanchez-Hernandez (ramsessanchez)
merged commit Aug 7, 2026
d9cb29a
into
main
6 of 8 checks passed
Ramses Sanchez-Hernandez (ramsessanchez)
deleted the
gavinbarron/cfs-npm-audit-off
branch
August 7, 2026 18:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stop remaining registry.npmjs.org egress in the Generation pipeline (CFSClean)
Context
PRs #3696 and #3697 routed autorest's npm calls and the Rush package registry to the private CFS feed (
PowerShell_V2_Build). Validation run 231003 (pipeline 187, on the merged #3697 content) built successfully and confirmed the autorest pre-populate leak is gone — but theMicrosoft Graph PowerShell SDK CI Buildjob still showed 2registry.npmjs.orghits, traced (network-isolation telemetry + build log) to theRush Buildstep.Root cause
rush installfirst self-installs Rush and pnpm vianpm install, and each of those runsnpm audit:npm auditPOSTs the dependency set to the publicregistry.npmjs.orgaudit endpoint (the private Azure Artifacts feed doesn't implement it), so the registry redirect alone can't stop it. Two self-installs ⇒ two npmjs hits.Fix
Add
audit=false(andfund=false) to the.npmrccontent written byConfigure-PrivateNpmFeed.ps1. Rush copies/transformscommon/config/rush/.npmrcto each self-install location, so these settings propagate to the offendingnpm installcalls.always-auth=trueand the privateregistry=are unchanged, so package resolution stays on the CFS feed.Validation
Re-run pipeline 187 after merge and confirm
registry.npmjs.org= 0 in the CI Build job. (PowerShell Gallery hits are a separate, looser CFSClean2 tier.)