You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit d57fcba
Browse filesBrowse the repository at this point in the historyBrowse files
Route package installs through Microsoft feed proxies (#1125)
* Route package installs through Microsoft feed proxies
Port vscode-isort setup, lockfile normalization, GitHub CI, and DevDiv release feed routing while preserving public Dependabot registries and legacy Azure pipeline definitions.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: e2972852-17e2-4e68-81e8-db73c74bfe25
* Remove redundant npm registry overrides from CI workflows
Let ci:msft explicitly select the npm proxy in PR and push workflows. Retain the Python index and registry configuration for CodeQL/Azure consumers, and add regression coverage and documentation.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: e2972852-17e2-4e68-81e8-db73c74bfe25
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: e2972852-17e2-4e68-81e8-db73c74bfe25
Copy file name to clipboardExpand all lines: README.md
+78Lines changed: 78 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -54,3 +54,81 @@ You can reference the table below to find the most recent Python Debugger extens
54
54
55
55
## Data and telemetry
56
56
The Debugpy Extension for Visual Studio Code collects usage data and sends it to Microsoft to help improve our products and services. Read our [privacy statement](https://privacy.microsoft.com/privacystatement) to learn more. This extension respects the `telemetry.telemetryLevel` setting which you can learn more about at https://code.visualstudio.com/docs/supporting/faq#_how-to-disable-telemetry-reporting.
57
+
58
+
### Local package feeds
59
+
60
+
Use Node.js supported by this repository and Python 3.10 or later. Both setup commands create or reuse `.venv` and install the Python bundling tools. Choose the appropriate setup below before installing dependencies. Committed lockfiles use public npm URLs; Microsoft setup rewrites working copies for proxy installs.
61
+
62
+
#### Public contributors (non-Microsoft employees)
63
+
64
+
Use the public setup, which selects `https://registry.npmjs.org/` and `https://pypi.org/simple/` for its child processes. No Microsoft account or internal-feed credentials are needed, and this command works before `node_modules` exists:
65
+
66
+
From the repository root:
67
+
68
+
```bash
69
+
npm run setup
70
+
```
71
+
72
+
For subsequent npm installs, use `npm ci`. Public contributors do not need the Microsoft feed commands or lockfile hook.
73
+
74
+
#### Microsoft employees only
75
+
76
+
> **Microsoft users only:** The commands in this section configure Microsoft package feeds. Public contributors should use the public setup above.
77
+
78
+
Use the Microsoft setup, which selects `https://packagefeedproxy.microsoft.io/npm/` and `https://packagefeedproxy.microsoft.io/pypi/simple/` for its child processes:
79
+
80
+
```bash
81
+
npm run setup:msft
82
+
```
83
+
84
+
Microsoft setup rewrites public npm and Yarn `resolved` URLs in the root `package-lock.json` to the npm proxy before running `npm ci`. Versions, integrity hashes, formatting, and private-feed URLs are preserved. The public setup leaves lockfiles unchanged.
85
+
86
+
After pulling a new lockfile from GitHub, rerun `npm run setup:msft`, or run the dependency-free rewrite step alone before your next install/build:
87
+
88
+
```bash
89
+
npm run setup:msft-registry
90
+
```
91
+
92
+
The standalone step requires the root lockfile to exist; it does not require a shared TypeScript checkout. Rewriting is idempotent and stops on missing or invalid lockfiles. Keep committed lockfile URLs public using the optional pre-commit hook below (or `npm run normalize-lockfile` for the root lockfile).
93
+
94
+
For subsequent root npm installs, use:
95
+
96
+
```bash
97
+
npm run ci:msft
98
+
```
99
+
100
+
This rewrites the root lockfile, then runs root `npm ci` with the proxy registry explicitly selected for package, audit, and metadata requests. Use `npm run setup:msft` for full setup, including Python dependencies.
101
+
102
+
Local setup, lockfile rewriting, and `ci:msft` share the feed URLs in `build/package-feeds.json`.
103
+
104
+
Both setup commands use the same implementation, stop on errors, and keep registry overrides scoped to setup's child processes; they do not change your shell environment, edit `.npmrc`, or add credentials. The standalone rewrite step only edits lockfiles; it does not configure the registry for subsequent commands.
105
+
106
+
After setup, run `npm run compile` to build the extension. For subsequent Python commands, use `.venv\Scripts\python.exe` on Windows or `.venv/bin/python` on macOS/Linux (or activate that virtual environment). Registry overrides are not retained after setup.
107
+
108
+
#### Microsoft contributor pre-commit hook
109
+
110
+
If you use the Microsoft feeds and will commit changes, enable the recommended lockfile hook once per clone (no installed npm dependencies are required). It is not needed just to install or build:
111
+
112
+
```bash
113
+
npm run setup-hooks
114
+
```
115
+
116
+
The installer sets the clone's local `core.hooksPath` to `.githooks`, which also affects its linked worktrees. It refuses to replace an existing hook or a different hooks configuration. If you already use hooks, add `node build/normalize-package-lock.js --staged` to your existing pre-commit hook instead. Only enable this configuration in worktrees/branches that contain these hook files.
117
+
118
+
Before a local commit, the hook converts known `Pylance_PublicPackages`, `packagefeedproxy.microsoft.io/npm/`, and named `1es-public/npm-public` mirror tarball URLs in the staged root `package-lock.json` to public npm URLs. It preserves versions, integrity hashes, formatting, and intentional Azure-hosted dependencies such as `msft_consumption`. Unknown feeds are left unchanged. It re-stages only the lockfile; if normalization is needed and the lockfile has unstaged changes, the commit is blocked without modifying it. Stage or stash those changes, then retry.
119
+
120
+
To normalize manually, run `npm run normalize-lockfile`, review the changes, and stage them. To disable the installed hook, run `git config --local --unset core.hooksPath`. These are local Git hooks: GitHub and Dependabot do not execute them. No workflow writes changes to PR branches.
121
+
122
+
### GitHub Actions package feeds
123
+
124
+
The PR and push workflows set `PIP_INDEX_URL` to `https://packagefeedproxy.microsoft.io/pypi/simple/` for pip and nox installs. Their Node installation steps select `https://packagefeedproxy.microsoft.io/npm/` explicitly through `npm run ci:msft`, so these workflows do not set `NPM_CONFIG_REGISTRY`. CodeQL retains both environment variables because its autobuild step does not use the install helper. The npm endpoint follows the [TypeScript CI package-feed-proxy job](https://github.com/microsoft/TypeScript/blob/main/.github/workflows/ci.yml).
125
+
126
+
The shared lint and VSIX build actions and applicable PR/push test jobs use `npm run ci:msft`, rewriting working-copy lockfile URLs before installation and explicitly selecting the proxy for npm requests. Workflows do not commit these rewrites or change local registry configuration or Dependabot configuration. Existing dependency caches are retained; the VSIX build also retains its offline-cache preference. CodeQL retains workflow-level feed settings for its autobuild step.
127
+
128
+
### Azure release package feeds
129
+
130
+
The DevDiv Azure stable/prerelease pipelines pass the npm proxy to their build/publish templates using `customNPMRegistry`. Their dependency install steps use `npm run ci:msft` to rewrite the root npm lockfile and install through the proxy.
131
+
132
+
Each Python bootstrap and bundled-library install step explicitly sets `PIP_INDEX_URL` from `PIP_PROXY_INDEX_URL`, selecting the pip proxy even when a template's authentication setup changes the job-level index. Release triggers, approval gates, signing, and publishing behavior are unchanged.
133
+
134
+
Dependabot continues to use public registries and its existing update settings. Legacy Azure stable, prerelease, and validation definitions are unchanged.
0 commit comments