Enforce CFSClean network isolation in 1ES pipelines

eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml

@@ -0,0 +1,42 @@
+parameters:
+  - name: npmrcPath
+    type: string
+    # When empty, defaults to the agent user's .npmrc ($HOME/.npmrc on
+    # Linux/macOS, %USERPROFILE%\.npmrc on Windows) so every subsequent
+    # npm / pnpm / npx call in the job inherits the registry + auth.
+    default: ""
+  - name: registryUrl
+    type: string
+    default: "https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-js/npm/registry/"
+  - name: CustomCondition
+    type: string
+    default: succeeded()
+  - name: ServiceConnection
+    type: string
+    default: ""
+
+steps:
+  - pwsh: |
+      $npmrcPath = '${{ parameters.npmrcPath }}'
+      if (-not $npmrcPath) { $npmrcPath = Join-Path $HOME '.npmrc' }
+
+      Write-Host "Creating .npmrc file $npmrcPath for registry ${{ parameters.registryUrl }}"
+      $parentFolder = Split-Path -Path $npmrcPath -Parent
+
+      if ($parentFolder -and -not (Test-Path $parentFolder)) {
+        Write-Host "Creating folder $parentFolder"
+        New-Item -Path $parentFolder -ItemType Directory | Out-Null
+      }
+
+      "registry=${{ parameters.registryUrl }}" | Out-File $npmrcPath
+      Write-Host "##vso[task.setvariable variable=resolvedNpmrcPath]$npmrcPath"
+      Write-Host "##vso[task.setvariable variable=resolvedNpmRegistryUrl]${{ parameters.registryUrl }}"
+    displayName: "Create .npmrc"
+    condition: ${{ parameters.CustomCondition }}
+
+  - task: npmAuthenticate@0
+    displayName: Authenticate .npmrc
+    condition: ${{ parameters.CustomCondition }}
+    inputs:
+      workingFile: $(resolvedNpmrcPath)
+      azureDevOpsServiceConnection: ${{ parameters.ServiceConnection }}

eng/pipelines/ci.yaml

@@ -24,6 +24,8 @@ extends:
 
               - script: pnpm run test:ci
                 displayName: Test
+                env:
+                  autorest_registry: $(resolvedNpmRegistryUrl)
 
               - task: PublishCodeCoverageResults@1
                 inputs:

eng/pipelines/templates/1es-redirect.yml

@@ -27,6 +27,7 @@ extends:
   parameters:
     settings:
       skipBuildTagsForGitHubPullRequests: true
+      networkIsolationPolicy: Permissive, CFSClean
     authenticatedContainerRegistries: ${{ parameters.authenticatedContainerRegistries }}
     sdl:
       git:

eng/pipelines/templates/build.yaml

@@ -5,8 +5,9 @@ steps:
       versionSpec: "22.x"
     displayName: "Install Node.js"
 
-  - script: corepack enable
-    displayName: "Enable corepack"
+  - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+
+  - template: /eng/pipelines/templates/install-pnpm.yml
 
   - script: pnpm install --frozen-lockfile
     displayName: "Install dependencies"

eng/pipelines/templates/install-pnpm.yml

@@ -0,0 +1,5 @@
+steps:
+  - pwsh: |
+      $packageJson = Get-Content -Raw "$(Build.SourcesDirectory)/package.json" | ConvertFrom-Json
+      npm install -g $packageJson.packageManager
+    displayName: Install pnpm

eng/pipelines/templates/regression-tests.yaml

@@ -44,9 +44,14 @@ jobs:
           versionSpec: "3.11"
         displayName: "Use Python 3.11"
 
+      - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+
+      - script: npm install -g npm
+        displayName: Install npm
+
+      - template: /eng/pipelines/templates/install-pnpm.yml
+
       - script: |
-          npm install -g npm
-          corepack enable
           pnpm install --frozen-lockfile
           pnpm run build
         displayName: Install and build
@@ -72,6 +77,10 @@ jobs:
 
       - script: autorest-compare --compare:./regression-tests/regression-compare.yaml --language:python
         displayName: Regression Test - @autorest/python
+        env:
+          autorest_registry: $(resolvedNpmRegistryUrl)
 
       - script: autorest-compare --compare:./regression-tests/regression-compare.yaml --language:typescript
         displayName: Regression Test - @autorest/typescript
+        env:
+          autorest_registry: $(resolvedNpmRegistryUrl)

eng/pipelines/templates/smoke-tests.yaml

@@ -38,6 +38,8 @@ jobs:
           versionSpec: ${{ parameters.nodeVersion }}
         displayName: "Install Node.js"
 
+      - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+
       - script: |
           # npm install -g autorest
           echo "Installing autorest from $AUTOREST_CLI_PKG"

packages/libs/extension/src/main.ts

@@ -213,7 +213,9 @@ export class ExtensionManager {
    * @returns List of semver versions
    */
   public async getPackageVersions(name: string): Promise<string[]> {
-    const packument = await pacote.packument(name);
+    const packument = await pacote.packument(name, {
+      registry: process.env.autorest_registry || "https://registry.npmjs.org",
+    });
     return Object.keys(packument.versions);
   }