Route NuGet restores through Central Feed Service

[fabiocav]

Summary

• replace the direct nuget.org source with the azfunc/public/upstream-public CFS feed, including a wildcard package source mapping
• authenticate CFS in both Azure Pipelines restore paths and prevent pack steps from performing implicit restores
• make GitHub Actions and the independently runnable smoke-test script restore through the repository config, then build/test/pack/publish with --no-restore
• preserve customer-facing samples and documentation; the repository has no npm or Python dependency manifests or install paths to configure

Validation

• forced a solution restore with empty isolated global-packages, HTTP, plugin, and CLI-home caches and diagnostic logging; observed 1,074 NuGet request lines through CFS/Azure Artifacts content endpoints and 0 direct requests to nuget.org
• built the solution, ran 1,462 tests across 17 test runs, and packed the solution without restoring
• restored, built, and packed the Azure Pipelines src/dirs.proj path; published the smoke-test app with an argument-array path containing spaces
• ran dotnet list package --vulnerable --include-transitive through CFS; it surfaced existing OpenTelemetry advisories in DistributedTracingSample without suppressing them
• inspected all 34 generated package artifacts and the 133-file publish output; no NuGet/npm configs, credentials, lockfiles, node_modules, or credential-like files were shipped

[Copilot]

🟡 Not ready to approve

The smoke-test script constructs the nuget.config path using Windows-style backslashes, but it is executed on Ubuntu in GitHub Actions, which can break dotnet restore --configfile resolution.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Routes all dotnet restore operations in CI and the Azure Functions smoke-test path through the repository’s nuget.config, replacing direct nuget.org usage with the azfunc/public/upstream-public Central Feed Service (Azure Artifacts) feed.

Changes:

• Updated nuget.config to use the CFS “upstream-public” feed with wildcard package source mapping.
• Added NuGet feed authentication in Azure Pipelines and prevented implicit restores during packing by using --no-restore.
• Updated GitHub Actions and the smoke-test runner script to restore via nuget.config and run subsequent commands with --no-restore.

File summaries

File	Description
test/AzureFunctionsSmokeTests/run-smoketests.ps1	Restore via repo nuget.config, then build/publish with --no-restore.
nuget.config	Replaces nuget.org source with the upstream-public CFS feed + source mapping.
eng/templates/build.yml	Adds NuGetAuthenticate and disables implicit restore during pack.
azure-pipelines-release.yml	Adds NuGetAuthenticate and disables implicit restore during pack.
.github/workflows/validate-build.yml	Restores with --configfile and adds --no-restore to downstream steps.
.github/workflows/codeQL.yml	Restores with --configfile and builds with --no-restore.
.github/workflows/azure-functions-smoke-tests.yml	Removes separate restore step, relying on the script’s restore path.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[Copilot]

🟢 Ready to approve

The changes consistently route restores through the repository NuGet configuration and correctly disable implicit restores across CI paths, with only a minor performance nit noted.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Suppressed comments (1)

test/AzureFunctionsSmokeTests/run-smoketests.ps1:107

• dotnet publish will do a build by default. Since this script already runs dotnet build in Step 1, the publish step is likely rebuilding the project unnecessarily. Add --no-build to the publish invocation to avoid duplicate compilation work and speed up the smoke test run.

        "--no-restore"

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[Copilot]

🟡 Human review recommended

It changes the repository’s package restore source and authentication behavior across CI systems, which is high-impact and should be validated with a final human review of environment-specific access/compatibility assumptions.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.