ci: Route Generation pipeline package restores through CFS feeds (CFSClean) (#1450)

* Route metadata/OpenAPI capture jobs through CFS feeds (CFSClean)

Pipeline 79 (Generation) fails CFSClean because the capture-metadata and capture-openapi jobs reach public package feeds: dotnet restore/tool-install -> api.nuget.org and npm install -> registry.npmjs.org. PR #1448 only covered the typewriter/kiota stages and wrote nuget.config to the sources dir, where a later 'checkout: self' wipes it.

Add reusable create-cfs-nuget-config.yml (NuGetAuthenticate + nuget.config written to Agent.TempDirectory so checkout cannot wipe it) and create-cfs-npmrc.yml (npmAuthenticate + CFS npm registry applied to the user profile). Wire both into capture-metadata.yml (after checkouts) and the nuget config into capture-openapi's convert_openapi job, and pass --configfile to the hidi 'dotnet tool install' steps. Feed: GraphDeveloperExperiences_Public (upstreams nuget.org and npmjs.org).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188

* Fix typewriter/kiota CFS nuget.config ordering (CFSClean)

The typewriter/kiota nuget.config was created in the job before build-and-publish-typewriter.yml runs 'checkout: self', which cleans the sources dir and wiped the untracked config -> dotnet build restored from nuget.org (22 api.nuget.org hits in build_and_publish_typewriter).

Move the CFS config creation to the reusable create-cfs-nuget-config.yml (writes to Agent.TempDirectory, checkout-proof). For typewriter, create it AFTER 'checkout: self' and restore via -p:RestoreConfigFile. For kiota, pass --configfile to the tool install. Remove the now-redundant inline NuGetAuthenticate/create-config steps from generation-pipeline.yml.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188

* Suppress dotnet CLI CDN checks to stop builds.dotnet.microsoft.com egress (CFSClean)

The Convert v1.0-graphexplorer job intermittently hit builds.dotnet.microsoft.com via dotnet.exe (not UseDotNet@2 and not generate-open-api.ps1, which only runs hidi locally). It is the dotnet CLI's workload/advertising-manifest + first-run checks piggybacking on the hidi 'dotnet tool install'. Set DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE, DOTNET_SKIP_WORKLOAD_INTEGRITY_CHECK, DOTNET_CLI_TELEMETRY_OPTOUT, DOTNET_NOLOGO as pipeline variables (surfaced as env vars to all steps) to suppress the CDN egress.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188

Author: gavinbarron

.azure-pipelines/generation-pipeline.yml

@@ -130,6 +130,14 @@ parameters:
   displayName: Skip Open API PR Generation.
 variables:
   buildConfiguration: 'Release'
+  # dotnet CLI hygiene for 1ES network isolation (CFSClean): stop the CLI from reaching the
+  # public .NET CDN (builds.dotnet.microsoft.com) for workload/advertising-manifest and
+  # first-run/telemetry checks that piggyback on any `dotnet` invocation (e.g. the hidi tool
+  # install). Pipeline variables are surfaced as environment variables to every step.
+  DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE: 'true'
+  DOTNET_SKIP_WORKLOAD_INTEGRITY_CHECK: 'true'
+  DOTNET_CLI_TELEMETRY_OPTOUT: 'true'
+  DOTNET_NOLOGO: 'true'
   cleanMetadataFileBeta: '$(Build.SourcesDirectory)/msgraph-metadata/clean_beta_metadata/cleanMetadataWithDescriptionsbeta.xml'
   cleanMetadataFileV1: '$(Build.SourcesDirectory)/msgraph-metadata/clean_v10_metadata/cleanMetadataWithDescriptionsv1.0.xml'
   cleanMetadataFileWithAnnotationsV1: '$(Build.SourcesDirectory)/msgraph-metadata/clean_v10_metadata/cleanMetadataWithDescriptionsAndAnnotationsv1.0.xml'
@@ -201,20 +209,6 @@ extends:
             targetPath: '$(Build.ArtifactStagingDirectory)'
             artifactName: typewriter
         steps:
-        - task: NuGetAuthenticate@1
-          displayName: 'Authenticate to Azure Artifacts'
-
-        - pwsh: |
-            @"
-            <?xml version="1.0" encoding="utf-8"?>
-            <configuration>
-              <packageSources>
-                <clear />
-                <add key="GraphDeveloperExperiences_Public" value="https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public/nuget/v3/index.json" />
-              </packageSources>
-            </configuration>
-            "@ | Set-Content -Path "$(Build.SourcesDirectory)/nuget.config" -Encoding UTF8
-          displayName: 'Create nuget.config (central feed)'
         - template: /.azure-pipelines/generation-templates/build-and-publish-typewriter.yml@self
     - stage: stage_build_and_publish_kiota
       dependsOn: [] # remove the implicit dependency to any previous stage
@@ -226,20 +220,7 @@ extends:
             targetPath: '$(Build.ArtifactStagingDirectory)'
             artifactName: kiota
         steps:
-        - task: NuGetAuthenticate@1
-          displayName: 'Authenticate to Azure Artifacts'
-
-        - pwsh: |
-            @"
-            <?xml version="1.0" encoding="utf-8"?>
-            <configuration>
-              <packageSources>
-                <clear />
-                <add key="GraphDeveloperExperiences_Public" value="https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public/nuget/v3/index.json" />
-              </packageSources>
-            </configuration>
-            "@ | Set-Content -Path "$(Build.SourcesDirectory)/nuget.config" -Encoding UTF8
-          displayName: 'Create nuget.config (central feed)'
+        - template: /.azure-pipelines/generation-templates/create-cfs-nuget-config.yml@self
         - template: /.azure-pipelines/generation-templates/build-and-publish-kiota.yml@self
 # Downloads the latest public beta metadata. If there are changes, we checkin
 # the public metadata into microsoftgraph/msgraph-metadata, and then run the

.azure-pipelines/generation-templates/build-and-publish-kiota.yml

@@ -1,5 +1,6 @@
 steps:
 - pwsh: |
     dotnet tool install Microsoft.OpenApi.Kiota `
-          --tool-path "$(Build.ArtifactStagingDirectory)"
+          --tool-path "$(Build.ArtifactStagingDirectory)" `
+          --configfile "$(Agent.TempDirectory)/nuget.config"
   displayName: 'Install Kiota via dotnet tool'

.azure-pipelines/generation-templates/build-and-publish-typewriter.yml

@@ -6,7 +6,11 @@ steps:
   submodules: recursive
   persistCredentials: true
 
-- pwsh: dotnet build $(Build.SourcesDirectory)/src/Typewriter/Typewriter.csproj --configuration $(buildConfiguration)
+# Create the CFS nuget.config AFTER checkout (a checkout clean would wipe a config written
+# into the sources dir) and restore against it, so dotnet build does not reach nuget.org.
+- template: /.azure-pipelines/generation-templates/create-cfs-nuget-config.yml@self
+
+- pwsh: dotnet build $(Build.SourcesDirectory)/src/Typewriter/Typewriter.csproj --configuration $(buildConfiguration) -p:RestoreConfigFile="$(Agent.TempDirectory)/nuget.config"
   displayName: 'Build Typewriter'
 
 - task: CopyFiles@2

.azure-pipelines/generation-templates/capture-metadata.yml

@@ -48,6 +48,11 @@ steps:
 - template: /.azure-pipelines/generation-templates/checkout-metadata.yml@self
 - template: /.azure-pipelines/generation-templates/set-user-config.yml@self
 
+# Route NuGet and npm through the CFS central feed for 1ES network isolation (CFSClean).
+# Placed after all checkouts so the generated config files are not wiped by a checkout clean.
+- template: /.azure-pipelines/generation-templates/create-cfs-nuget-config.yml@self
+- template: /.azure-pipelines/generation-templates/create-cfs-npmrc.yml@self
+
 # required for TypeSpec
 - task: UseNode@1
   inputs:
@@ -153,7 +158,7 @@ steps:
   parameters:
     version: '9.x'
 
-- pwsh: dotnet tool install --global Microsoft.OpenApi.Hidi --version 1.*
+- pwsh: dotnet tool install --global Microsoft.OpenApi.Hidi --version 1.* --configfile "$(Agent.TempDirectory)/nuget.config"
   displayName: 'Install hidi tool'
 
 # verify that generated metadata is parsable as an Edm model

.azure-pipelines/generation-templates/capture-openapi.yml

@@ -61,6 +61,9 @@ jobs:
     persistCredentials: true
 
   - template: /.azure-pipelines/generation-templates/checkout-metadata.yml@self
+  # Route NuGet through the CFS central feed for 1ES network isolation (CFSClean).
+  # Placed after all checkouts so the generated config is not wiped by a checkout clean.
+  - template: /.azure-pipelines/generation-templates/create-cfs-nuget-config.yml@self
   # required for the hidi to run
   - template: /.azure-pipelines/generation-templates/use-dotnet-sdk.yml@self
     parameters:
@@ -71,7 +74,7 @@ jobs:
     parameters:
       version: '9.x'
 
-  - pwsh: dotnet tool install --global Microsoft.OpenApi.Hidi --version 1.*
+  - pwsh: dotnet tool install --global Microsoft.OpenApi.Hidi --version 1.* --configfile "$(Agent.TempDirectory)/nuget.config"
     displayName: install hidi
 
   - pwsh: |

.azure-pipelines/generation-templates/create-cfs-npmrc.yml

@@ -0,0 +1,20 @@
+# Routes npm through the CFS central feed (GraphDeveloperExperiences_Public, which upstreams
+# npmjs.org) instead of hitting registry.npmjs.org directly, for 1ES network isolation (CFSClean).
+# The authenticated .npmrc is copied to the user profile so both global (`npm install -g`) and
+# project (`npm ci`) commands pick up the registry + credentials without per-step configuration.
+steps:
+- pwsh: |
+    @"
+    registry=https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public/npm/registry/
+    always-auth=true
+    "@ | Set-Content -Path "$(Agent.TempDirectory)/.npmrc" -Encoding UTF8
+  displayName: 'Create .npmrc (CFS central feed)'
+
+- task: npmAuthenticate@0
+  displayName: 'Authenticate npm to CFS feed'
+  inputs:
+    workingFile: '$(Agent.TempDirectory)/.npmrc'
+
+- pwsh: |
+    Copy-Item -Path "$(Agent.TempDirectory)/.npmrc" -Destination (Join-Path $HOME '.npmrc') -Force
+  displayName: 'Apply CFS .npmrc to user profile'

.azure-pipelines/generation-templates/create-cfs-nuget-config.yml

@@ -0,0 +1,20 @@
+# Routes dotnet/NuGet restore and tool installs through the CFS central package feed
+# (GraphDeveloperExperiences_Public) instead of public nuget.org, for 1ES network isolation
+# (CFSClean). The config is written to $(Agent.TempDirectory) so it survives any subsequent
+# `checkout` step (which cleans the sources directory and would wipe a config placed there).
+# Consumers must pass `--configfile "$(Agent.TempDirectory)/nuget.config"` to dotnet commands.
+steps:
+- task: NuGetAuthenticate@1
+  displayName: 'Authenticate to Azure Artifacts (CFS feed)'
+
+- pwsh: |
+    @"
+    <?xml version="1.0" encoding="utf-8"?>
+    <configuration>
+      <packageSources>
+        <clear />
+        <add key="GraphDeveloperExperiences_Public" value="https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public/nuget/v3/index.json" />
+      </packageSources>
+    </configuration>
+    "@ | Set-Content -Path "$(Agent.TempDirectory)/nuget.config" -Encoding UTF8
+  displayName: 'Create nuget.config (CFS central feed)'