From 9e6f8f96991072f2cff0ae3969a8aca6f9672a82 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Aug 2026 02:56:01 +0000
Subject: [PATCH 1/6] Enforce CFSClean network isolation

Co-authored-by: mikeharder <9459391+mikeharder@users.noreply.github.com>
---
 eng/pipelines/templates/1es-redirect.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/eng/pipelines/templates/1es-redirect.yml b/eng/pipelines/templates/1es-redirect.yml
index ebf7209d8b..102f39345f 100644
--- a/eng/pipelines/templates/1es-redirect.yml
+++ b/eng/pipelines/templates/1es-redirect.yml
@@ -27,6 +27,7 @@ extends:
   parameters:
     settings:
       skipBuildTagsForGitHubPullRequests: true
+      networkIsolationPolicy: Permissive, CFSClean
     authenticatedContainerRegistries: ${{ parameters.authenticatedContainerRegistries }}
     sdl:
       git:

From d1679cf59333b134b5363991b7ee7c863e0b03f7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Aug 2026 03:25:58 +0000
Subject: [PATCH 2/6] Install pinned pnpm in pipelines

Co-authored-by: mikeharder <9459391+mikeharder@users.noreply.github.com>
---
 eng/pipelines/templates/build.yaml            | 3 +--
 eng/pipelines/templates/install-pnpm.yml      | 5 +++++
 eng/pipelines/templates/regression-tests.yaml | 7 +++++--
 3 files changed, 11 insertions(+), 4 deletions(-)
 create mode 100644 eng/pipelines/templates/install-pnpm.yml

diff --git a/eng/pipelines/templates/build.yaml b/eng/pipelines/templates/build.yaml
index 45715951a2..c9f12150a6 100644
--- a/eng/pipelines/templates/build.yaml
+++ b/eng/pipelines/templates/build.yaml
@@ -5,8 +5,7 @@ steps:
       versionSpec: "22.x"
     displayName: "Install Node.js"
 
-  - script: corepack enable
-    displayName: "Enable corepack"
+  - template: /eng/pipelines/templates/install-pnpm.yml
 
   - script: pnpm install --frozen-lockfile
     displayName: "Install dependencies"
diff --git a/eng/pipelines/templates/install-pnpm.yml b/eng/pipelines/templates/install-pnpm.yml
new file mode 100644
index 0000000000..c0aa81e312
--- /dev/null
+++ b/eng/pipelines/templates/install-pnpm.yml
@@ -0,0 +1,5 @@
+steps:
+  - pwsh: |
+      $packageJson = Get-Content -Raw "$(Build.SourcesDirectory)/package.json" | ConvertFrom-Json
+      npm install -g $packageJson.packageManager
+    displayName: Install pnpm
diff --git a/eng/pipelines/templates/regression-tests.yaml b/eng/pipelines/templates/regression-tests.yaml
index fe739b6c93..1f7c7f1a98 100644
--- a/eng/pipelines/templates/regression-tests.yaml
+++ b/eng/pipelines/templates/regression-tests.yaml
@@ -44,9 +44,12 @@ jobs:
           versionSpec: "3.11"
         displayName: "Use Python 3.11"
 
+      - script: npm install -g npm
+        displayName: Install npm
+
+      - template: /eng/pipelines/templates/install-pnpm.yml
+
       - script: |
-          npm install -g npm
-          corepack enable
           pnpm install --frozen-lockfile
           pnpm run build
         displayName: Install and build

From 4c0a5307b89391151316ef844f8f1f46b244125b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Aug 2026 03:39:42 +0000
Subject: [PATCH 3/6] Authenticate npm in isolated pipelines

Co-authored-by: mikeharder <9459391+mikeharder@users.noreply.github.com>
---
 .../steps/create-authenticated-npmrc.yml      | 41 +++++++++++++++++++
 eng/pipelines/templates/build.yaml            |  2 +
 eng/pipelines/templates/regression-tests.yaml |  2 +
 eng/pipelines/templates/smoke-tests.yaml      |  2 +
 4 files changed, 47 insertions(+)
 create mode 100644 eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml

diff --git a/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml b/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
new file mode 100644
index 0000000000..3fa699b387
--- /dev/null
+++ b/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
@@ -0,0 +1,41 @@
+parameters:
+  - name: npmrcPath
+    type: string
+    # When empty, defaults to the agent user's .npmrc ($HOME/.npmrc on
+    # Linux/macOS, %USERPROFILE%\.npmrc on Windows) so every subsequent
+    # npm / pnpm / npx call in the job inherits the registry + auth.
+    default: ""
+  - name: registryUrl
+    type: string
+    default: "https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-js/npm/registry/"
+  - name: CustomCondition
+    type: string
+    default: succeeded()
+  - name: ServiceConnection
+    type: string
+    default: ""
+
+steps:
+  - pwsh: |
+      $npmrcPath = '${{ parameters.npmrcPath }}'
+      if (-not $npmrcPath) { $npmrcPath = Join-Path $HOME '.npmrc' }
+
+      Write-Host "Creating .npmrc file $npmrcPath for registry ${{ parameters.registryUrl }}"
+      $parentFolder = Split-Path -Path $npmrcPath -Parent
+
+      if ($parentFolder -and -not (Test-Path $parentFolder)) {
+        Write-Host "Creating folder $parentFolder"
+        New-Item -Path $parentFolder -ItemType Directory | Out-Null
+      }
+
+      "registry=${{ parameters.registryUrl }}" | Out-File $npmrcPath
+      Write-Host "##vso[task.setvariable variable=resolvedNpmrcPath]$npmrcPath"
+    displayName: "Create .npmrc"
+    condition: ${{ parameters.CustomCondition }}
+
+  - task: npmAuthenticate@0
+    displayName: Authenticate .npmrc
+    condition: ${{ parameters.CustomCondition }}
+    inputs:
+      workingFile: $(resolvedNpmrcPath)
+      azureDevOpsServiceConnection: ${{ parameters.ServiceConnection }}
diff --git a/eng/pipelines/templates/build.yaml b/eng/pipelines/templates/build.yaml
index c9f12150a6..4e8522369d 100644
--- a/eng/pipelines/templates/build.yaml
+++ b/eng/pipelines/templates/build.yaml
@@ -5,6 +5,8 @@ steps:
       versionSpec: "22.x"
     displayName: "Install Node.js"
 
+  - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+
   - template: /eng/pipelines/templates/install-pnpm.yml
 
   - script: pnpm install --frozen-lockfile
diff --git a/eng/pipelines/templates/regression-tests.yaml b/eng/pipelines/templates/regression-tests.yaml
index 1f7c7f1a98..2feba821b4 100644
--- a/eng/pipelines/templates/regression-tests.yaml
+++ b/eng/pipelines/templates/regression-tests.yaml
@@ -44,6 +44,8 @@ jobs:
           versionSpec: "3.11"
         displayName: "Use Python 3.11"
 
+      - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+
       - script: npm install -g npm
         displayName: Install npm
 
diff --git a/eng/pipelines/templates/smoke-tests.yaml b/eng/pipelines/templates/smoke-tests.yaml
index 75db53a9c5..def89f36c8 100644
--- a/eng/pipelines/templates/smoke-tests.yaml
+++ b/eng/pipelines/templates/smoke-tests.yaml
@@ -38,6 +38,8 @@ jobs:
           versionSpec: ${{ parameters.nodeVersion }}
         displayName: "Install Node.js"
 
+      - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+
       - script: |
           # npm install -g autorest
           echo "Installing autorest from $AUTOREST_CLI_PKG"

From eb3ac77df3f1a647b1b3f52b52fd02ecb25afedf Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Aug 2026 04:06:09 +0000
Subject: [PATCH 4/6] Route extension tests through authenticated registry

Co-authored-by: mikeharder <9459391+mikeharder@users.noreply.github.com>
---
 .../pipelines/templates/steps/create-authenticated-npmrc.yml  | 1 +
 eng/pipelines/ci.yaml                                         | 2 ++
 eng/pipelines/templates/regression-tests.yaml                 | 4 ++++
 3 files changed, 7 insertions(+)

diff --git a/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml b/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
index 3fa699b387..02e04dbbd5 100644
--- a/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+++ b/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
@@ -30,6 +30,7 @@ steps:
 
       "registry=${{ parameters.registryUrl }}" | Out-File $npmrcPath
       Write-Host "##vso[task.setvariable variable=resolvedNpmrcPath]$npmrcPath"
+      Write-Host "##vso[task.setvariable variable=resolvedNpmRegistryUrl]${{ parameters.registryUrl }}"
     displayName: "Create .npmrc"
     condition: ${{ parameters.CustomCondition }}
 
diff --git a/eng/pipelines/ci.yaml b/eng/pipelines/ci.yaml
index 9b57fc44aa..e7a166ffe2 100644
--- a/eng/pipelines/ci.yaml
+++ b/eng/pipelines/ci.yaml
@@ -24,6 +24,8 @@ extends:
 
               - script: pnpm run test:ci
                 displayName: Test
+                env:
+                  autorest_registry: $(resolvedNpmRegistryUrl)
 
               - task: PublishCodeCoverageResults@1
                 inputs:
diff --git a/eng/pipelines/templates/regression-tests.yaml b/eng/pipelines/templates/regression-tests.yaml
index 2feba821b4..469d07b145 100644
--- a/eng/pipelines/templates/regression-tests.yaml
+++ b/eng/pipelines/templates/regression-tests.yaml
@@ -77,6 +77,10 @@ jobs:
 
       - script: autorest-compare --compare:./regression-tests/regression-compare.yaml --language:python
         displayName: Regression Test - @autorest/python
+        env:
+          autorest_registry: $(resolvedNpmRegistryUrl)
 
       - script: autorest-compare --compare:./regression-tests/regression-compare.yaml --language:typescript
         displayName: Regression Test - @autorest/typescript
+        env:
+          autorest_registry: $(resolvedNpmRegistryUrl)

From 2b2df35f5374b8dd47bf63ccd49b458e64ba2472 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Thu, 6 Aug 2026 14:59:52 -0700
Subject: [PATCH 5/6] [getPackageVersions] Respect autorest_registry env var

---
 packages/libs/extension/src/main.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/libs/extension/src/main.ts b/packages/libs/extension/src/main.ts
index b3ab05e0f2..bb57c349fd 100644
--- a/packages/libs/extension/src/main.ts
+++ b/packages/libs/extension/src/main.ts
@@ -213,7 +213,9 @@ export class ExtensionManager {
    * @returns List of semver versions
    */
   public async getPackageVersions(name: string): Promise<string[]> {
-    const packument = await pacote.packument(name);
+    const packument = await pacote.packument(name, {
+      registry: process.env.autorest_registry || "https://registry.npmjs.org",
+    });
     return Object.keys(packument.versions);
   }
 

From 9e350f0c1f661b77c0017f179a61fbebece3e9d9 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Thu, 6 Aug 2026 16:34:04 -0700
Subject: [PATCH 6/6] Enable Python CFS when running regression tests

---
 eng/pipelines/templates/regression-tests.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/eng/pipelines/templates/regression-tests.yaml b/eng/pipelines/templates/regression-tests.yaml
index 469d07b145..056fd7db5c 100644
--- a/eng/pipelines/templates/regression-tests.yaml
+++ b/eng/pipelines/templates/regression-tests.yaml
@@ -75,10 +75,17 @@ jobs:
         displayName: Install dependencies
         workingDirectory: regression-tests
 
+      - task: PipAuthenticate@1
+        displayName: "Pip Authenticate to feed"
+        inputs:
+          artifactFeeds: "public/azure-sdk-for-python"
+          onlyAddExtraIndex: false
+
       - script: autorest-compare --compare:./regression-tests/regression-compare.yaml --language:python
         displayName: Regression Test - @autorest/python
         env:
           autorest_registry: $(resolvedNpmRegistryUrl)
+          PIP_INDEX_URL: https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-python/pypi/simple/
 
       - script: autorest-compare --compare:./regression-tests/regression-compare.yaml --language:typescript
         displayName: Regression Test - @autorest/typescript