From fdd4c23a8a03b078a95ed865c62bffa5fa9535f9 Mon Sep 17 00:00:00 2001 From: "Gavin Barron (from Dev Box)" Date: Thu, 13 Aug 2026 14:51:51 -0700 Subject: [PATCH 1/2] Force Rush toolchain self-install onto the private npm feed (CFSClean) After #3696/#3697/#3703, pipeline 187's SDK dependency restore is clean, but 2 residual registry.npmjs.org hits remain in the Rush Build step. They are Rush self-installing its own toolchain: `rush install` downloads the pinned Rush and pnpm packages into ~/.rush via `npm install`, and those npm invocations do not honor the transformed common/config/rush/.npmrc registry, so they fall back to registry.npmjs.org (verified: build 231349, node.exe during Rush Build). Fix: set $env:npm_config_registry to the authenticated private feed (read from ~/.npmrc) at the top of the Rush Build step, mirroring the same approach already used in GenerateServiceModule.ps1 for autorest's internal npm calls. npm_config_registry is the highest-precedence npm config source and is inherited by every child process (npx -> rush -> npm), so it covers the self-install npm calls that bypass the .npmrc. Auth continues to come from ~/.npmrc (the URL matches). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188 --- .../common-templates/install-tools.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.azure-pipelines/common-templates/install-tools.yml b/.azure-pipelines/common-templates/install-tools.yml index 0b64943de1..fd6aa51dd8 100644 --- a/.azure-pipelines/common-templates/install-tools.yml +++ b/.azure-pipelines/common-templates/install-tools.yml @@ -96,6 +96,21 @@ steps: pwsh: true workingDirectory: "autorest.powershell" script: | + # Belt-and-suspenders for 1ES network isolation (CFSClean): force npm_config_registry to + # the authenticated private feed so Rush's self-install of its own toolchain (the Rush and + # pnpm packages it downloads into ~/.rush via `npm install`) resolves from the private feed + # instead of defaulting to registry.npmjs.org. The env var is the highest-precedence npm + # config source and is inherited by every child process, so it covers the self-install npm + # calls that do not pick up the transformed common/config/rush/.npmrc. + if (-not $env:npm_config_registry) { + $userNpmrc = Join-Path $env:USERPROFILE ".npmrc" + if (Test-Path $userNpmrc) { + $regLine = Select-String -Path $userNpmrc -Pattern '^registry=' | Select-Object -First 1 + if ($regLine) { $env:npm_config_registry = ($regLine.Line -replace '^registry=', '').Trim() } + } + } + Write-Host "npm_config_registry = $env:npm_config_registry" + npx --no-install rush install if ($LASTEXITCODE -ne 0) { throw "rush install failed with exit code $LASTEXITCODE" } npx --no-install rush link From a14c5d886a03304391f0762c00ddfcfadb32ad33 Mon Sep 17 00:00:00 2001 From: "Gavin Barron (from Dev Box)" Date: Thu, 13 Aug 2026 15:44:03 -0700 Subject: [PATCH 2/2] Add retryCountOnTaskFailure to transient tool-install steps (build reliability) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Weekly PowerShell V2 Build (221) intermittently fails at network-dependent tool-install steps in the shared install-tools.yml (observed: UseDotNet@2 extraction collision "dotnet.exe already exists", and Install Rush). These are transient — 187/663 pass on the same template. Add retryCountOnTaskFailure: 2 to the UseDotNet@2 (x2), NodeTool@0, and the three Npm@1 install steps so a transient failure retries instead of failing the whole generation build, improving the odds of a clean, trustworthy CFSClean validation run. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188 --- .azure-pipelines/common-templates/install-tools.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.azure-pipelines/common-templates/install-tools.yml b/.azure-pipelines/common-templates/install-tools.yml index fd6aa51dd8..6201656d73 100644 --- a/.azure-pipelines/common-templates/install-tools.yml +++ b/.azure-pipelines/common-templates/install-tools.yml @@ -4,11 +4,13 @@ steps: - task: UseDotNet@2 displayName: Use .NET SDK + retryCountOnTaskFailure: 2 inputs: version: 8.x - task: UseDotNet@2 displayName: Use .NET SDK + retryCountOnTaskFailure: 2 inputs: version: 6.x @@ -27,6 +29,7 @@ steps: - task: NodeTool@0 displayName: Install NodeJs + retryCountOnTaskFailure: 2 inputs: versionSpec: 18.x @@ -63,6 +66,7 @@ steps: - task: Npm@1 displayName: Install AutoRest + retryCountOnTaskFailure: 2 inputs: command: custom workingDir: $(Build.SourcesDirectory) @@ -70,6 +74,7 @@ steps: - task: Npm@1 displayName: Install AutorestCore + retryCountOnTaskFailure: 2 inputs: command: custom workingDir: $(Build.SourcesDirectory) @@ -84,6 +89,7 @@ steps: - task: Npm@1 displayName: Install Rush + retryCountOnTaskFailure: 2 inputs: command: custom workingDir: $(Build.SourcesDirectory)