From bcd949af99ece0dffb431f6f4905d8d5442ed391 Mon Sep 17 00:00:00 2001 From: "Gavin Barron (from Dev Box)" Date: Wed, 19 Aug 2026 17:24:20 -0700 Subject: [PATCH 1/6] ci: TEMPORARY CFSClean diagnostic - dump npmjs tarball resolutions After `rush install`, print the entries in the re-resolved common/temp/pnpm-lock.yaml that resolved to registry.npmjs.org, to identify exactly which package(s) egress to public npm under 1ES network isolation. To be reverted once the culprits are identified. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0 --- .../common-templates/install-tools.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.azure-pipelines/common-templates/install-tools.yml b/.azure-pipelines/common-templates/install-tools.yml index c1f65040840..d66309a3953 100644 --- a/.azure-pipelines/common-templates/install-tools.yml +++ b/.azure-pipelines/common-templates/install-tools.yml @@ -129,6 +129,23 @@ steps: npx --no-install rush install if ($LASTEXITCODE -ne 0) { throw "rush install failed with exit code $LASTEXITCODE" } + + # >>> TEMPORARY CFSClean DIAGNOSTIC (revert before merge) <<< + # After rush install, the re-resolved lockfile in common/temp records the tarball URL that + # pnpm actually resolved for each package. Print every entry that resolved to public npm so + # we can identify exactly which package(s) egress to registry.npmjs.org under 1ES isolation. + $tempLock = "common/temp/pnpm-lock.yaml" + if (Test-Path $tempLock) { + Write-Host "===== CFSClean diagnostic: npmjs.org tarball resolutions in $tempLock =====" + $hits = Select-String -Path $tempLock -Pattern 'registry\.npmjs\.(org|com)' -Context 4,0 + if ($hits) { $hits | ForEach-Object { $_.Context.PreContext + $_.Line | ForEach-Object { Write-Host $_ } ; Write-Host "----" } } + else { Write-Host "No registry.npmjs.org tarball URLs found in the re-resolved temp lockfile." } + Write-Host "===== end CFSClean diagnostic =====" + } else { + Write-Host "CFSClean diagnostic: $tempLock not found" + } + # >>> END TEMPORARY CFSClean DIAGNOSTIC <<< + npx --no-install rush link if ($LASTEXITCODE -ne 0) { throw "rush link failed with exit code $LASTEXITCODE" } npx --no-install rush rebuild From ee4863ca27f4de7bde7cb21e819c9b6e8f84253f Mon Sep 17 00:00:00 2001 From: "Gavin Barron (from Dev Box)" Date: Wed, 19 Aug 2026 18:02:56 -0700 Subject: [PATCH 2/6] ci: diagnostic v2 - list pnpm metadata cache entries from npmjs Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0 --- .../common-templates/install-tools.yml | 25 ++++++++++++++----- 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/.azure-pipelines/common-templates/install-tools.yml b/.azure-pipelines/common-templates/install-tools.yml index d66309a3953..8566de071a9 100644 --- a/.azure-pipelines/common-templates/install-tools.yml +++ b/.azure-pipelines/common-templates/install-tools.yml @@ -131,19 +131,32 @@ steps: if ($LASTEXITCODE -ne 0) { throw "rush install failed with exit code $LASTEXITCODE" } # >>> TEMPORARY CFSClean DIAGNOSTIC (revert before merge) <<< - # After rush install, the re-resolved lockfile in common/temp records the tarball URL that - # pnpm actually resolved for each package. Print every entry that resolved to public npm so - # we can identify exactly which package(s) egress to registry.npmjs.org under 1ES isolation. + # The 2x registry.npmjs.org egress are metadata (packument) requests, not tarball + # downloads (the re-resolved lockfile has 0 npmjs URLs). pnpm caches packument metadata + # under /metadata(-vN)//, so listing the npmjs host folder + # names exactly which package(s) pnpm queried from public npm. $tempLock = "common/temp/pnpm-lock.yaml" if (Test-Path $tempLock) { Write-Host "===== CFSClean diagnostic: npmjs.org tarball resolutions in $tempLock =====" $hits = Select-String -Path $tempLock -Pattern 'registry\.npmjs\.(org|com)' -Context 4,0 if ($hits) { $hits | ForEach-Object { $_.Context.PreContext + $_.Line | ForEach-Object { Write-Host $_ } ; Write-Host "----" } } else { Write-Host "No registry.npmjs.org tarball URLs found in the re-resolved temp lockfile." } - Write-Host "===== end CFSClean diagnostic =====" - } else { - Write-Host "CFSClean diagnostic: $tempLock not found" } + Write-Host "===== CFSClean diagnostic: pnpm metadata cache entries from registry.npmjs.org =====" + $cacheDir = (& npx --no-install pnpm config get cacheDir 2>$null | Select-Object -Last 1) + Write-Host "pnpm cacheDir = $cacheDir" + $roots = @($cacheDir, "$env:LOCALAPPDATA\pnpm\cache", "$env:USERPROFILE\.local\share\pnpm\cache", "$env:USERPROFILE\.pnpm-store", "common/temp/.pnpm-store") | Where-Object { $_ -and (Test-Path $_) } | Select-Object -Unique + $found = $false + foreach ($root in $roots) { + $md = Get-ChildItem -Recurse -Path $root -Directory -ErrorAction SilentlyContinue | Where-Object { $_.FullName -match 'registry\.npmjs\.(org|com)' } + foreach ($d in $md) { + $found = $true + Write-Host "npmjs metadata dir: $($d.FullName)" + Get-ChildItem -Recurse -Path $d.FullName -File -ErrorAction SilentlyContinue | Select-Object -First 100 | ForEach-Object { Write-Host " $($_.FullName.Substring($d.FullName.Length))" } + } + } + if (-not $found) { Write-Host "No registry.npmjs.org metadata cache dirs found under: $($roots -join '; ')" } + Write-Host "===== end CFSClean diagnostic =====" # >>> END TEMPORARY CFSClean DIAGNOSTIC <<< npx --no-install rush link From 78eaf76b8dc04bb708541644fc0e98041736152b Mon Sep 17 00:00:00 2001 From: "Gavin Barron (from Dev Box)" Date: Wed, 19 Aug 2026 18:23:12 -0700 Subject: [PATCH 3/6] ci: TEMP enforce network isolation (no Npm) + skip generation for npmjs diagnostic Enforce networkIsolationMode with policy Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3 (deliberately omitting Npm) so public registry.npmjs.org egress is blocked and the failing pnpm fetch names the culprit package. Generation/downstream steps disabled to keep the build fast. To be reverted before merge. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0 --- .azure-pipelines/ci-build.yml | 63 +++++++++++-------- .../common-templates/install-tools.yml | 18 +++--- 2 files changed, 45 insertions(+), 36 deletions(-) diff --git a/.azure-pipelines/ci-build.yml b/.azure-pipelines/ci-build.yml index 835d60c9fd7..c595fd371d3 100644 --- a/.azure-pipelines/ci-build.yml +++ b/.azure-pipelines/ci-build.yml @@ -51,6 +51,11 @@ extends: template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates parameters: pool: $(BuildAgent) + # TEMP (CFS npmjs diagnostic): enforce network isolation with the target policy set so we can + # see exactly what breaks under enforcement. Revert before merge. + settings: + networkIsolationMode: Enforce + networkIsolationPolicy: Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3 sdl: binskim: enabled: false @@ -106,34 +111,38 @@ extends: git submodule update --init --recursive - template: .azure-pipelines/common-templates/install-tools.yml@self - template: .azure-pipelines/common-templates/security-pre-checks.yml@self - - - template: .azure-pipelines/generation-templates/authentication-module.yml@self - parameters: - Test: ${{ parameters.Test }} - Pack: ${{ parameters.Pack }} - Sign: ${{ parameters.Sign }} - - template: .azure-pipelines/generation-templates/workload-modules.yml@self - parameters: - Test: ${{ parameters.Test }} - Pack: ${{ parameters.Pack }} - Sign: ${{ parameters.Sign }} - - - template: .azure-pipelines/generation-templates/meta-module.yml@self - parameters: - Test: ${{ parameters.Test }} - Pack: ${{ parameters.Pack }} - Sign: ${{ parameters.Sign }} - - - template: .azure-pipelines/common-templates/guardian-analyzer.yml@self - - - ${{ if and(eq(parameters.Pack, true), eq(parameters.Sign, true)) }}: - - template: .azure-pipelines/common-templates/esrp/codesign-nuget.yml@self - parameters: - FolderPath: "$(Build.ArtifactStagingDirectory)" - Pattern: "Microsoft.Graph*.nupkg" - - - template: .azure-pipelines/common-templates/security-post-checks.yml@self + # >>> TEMP (CFS npmjs diagnostic): generation + downstream steps disabled to speed up the + # exploratory build. The npmjs egress happens in install-tools.yml (Rush Build) above, so we + # do not need module generation to reproduce it. Revert before merge. <<< + # - template: .azure-pipelines/generation-templates/authentication-module.yml@self + # parameters: + # Test: ${{ parameters.Test }} + # Pack: ${{ parameters.Pack }} + # Sign: ${{ parameters.Sign }} + # + # - template: .azure-pipelines/generation-templates/workload-modules.yml@self + # parameters: + # Test: ${{ parameters.Test }} + # Pack: ${{ parameters.Pack }} + # Sign: ${{ parameters.Sign }} + # + # - template: .azure-pipelines/generation-templates/meta-module.yml@self + # parameters: + # Test: ${{ parameters.Test }} + # Pack: ${{ parameters.Pack }} + # Sign: ${{ parameters.Sign }} + # + # - template: .azure-pipelines/common-templates/guardian-analyzer.yml@self + # + # - ${{ if and(eq(parameters.Pack, true), eq(parameters.Sign, true)) }}: + # - template: .azure-pipelines/common-templates/esrp/codesign-nuget.yml@self + # parameters: + # FolderPath: "$(Build.ArtifactStagingDirectory)" + # Pattern: "Microsoft.Graph*.nupkg" + # + # - template: .azure-pipelines/common-templates/security-post-checks.yml@self + # >>> END TEMP generation disable <<< - ${{ if and(eq(parameters.Pack, true), eq(parameters.Sign, true)) }}: - stage: Deploy_to_ACR displayName: Deploy PowerShell packages to ACR diff --git a/.azure-pipelines/common-templates/install-tools.yml b/.azure-pipelines/common-templates/install-tools.yml index 8566de071a9..b31613dea89 100644 --- a/.azure-pipelines/common-templates/install-tools.yml +++ b/.azure-pipelines/common-templates/install-tools.yml @@ -143,19 +143,19 @@ steps: else { Write-Host "No registry.npmjs.org tarball URLs found in the re-resolved temp lockfile." } } Write-Host "===== CFSClean diagnostic: pnpm metadata cache entries from registry.npmjs.org =====" - $cacheDir = (& npx --no-install pnpm config get cacheDir 2>$null | Select-Object -Last 1) - Write-Host "pnpm cacheDir = $cacheDir" - $roots = @($cacheDir, "$env:LOCALAPPDATA\pnpm\cache", "$env:USERPROFILE\.local\share\pnpm\cache", "$env:USERPROFILE\.pnpm-store", "common/temp/.pnpm-store") | Where-Object { $_ -and (Test-Path $_) } | Select-Object -Unique + Write-Host "--- transformed common/temp/.npmrc registry lines ---" + if (Test-Path "common/temp/.npmrc") { Select-String -Path "common/temp/.npmrc" -Pattern 'registry' | ForEach-Object { Write-Host $_.Line } } + $searchRoots = @("$env:LOCALAPPDATA", "$env:APPDATA", "$env:USERPROFILE\.rush", "$env:USERPROFILE\.pnpm-store", "$env:USERPROFILE\.cache", "common/temp") | Where-Object { $_ -and (Test-Path $_) } | Select-Object -Unique $found = $false - foreach ($root in $roots) { - $md = Get-ChildItem -Recurse -Path $root -Directory -ErrorAction SilentlyContinue | Where-Object { $_.FullName -match 'registry\.npmjs\.(org|com)' } - foreach ($d in $md) { + foreach ($root in $searchRoots) { + $dirs = Get-ChildItem -Path $root -Recurse -Directory -Filter 'registry.npmjs.org' -ErrorAction SilentlyContinue -Depth 8 + foreach ($d in $dirs) { $found = $true - Write-Host "npmjs metadata dir: $($d.FullName)" - Get-ChildItem -Recurse -Path $d.FullName -File -ErrorAction SilentlyContinue | Select-Object -First 100 | ForEach-Object { Write-Host " $($_.FullName.Substring($d.FullName.Length))" } + Write-Host "npmjs metadata/cache dir: $($d.FullName)" + Get-ChildItem -Path $d.FullName -Recurse -File -ErrorAction SilentlyContinue | Select-Object -First 80 | ForEach-Object { Write-Host " $($_.FullName.Substring($d.FullName.Length))" } } } - if (-not $found) { Write-Host "No registry.npmjs.org metadata cache dirs found under: $($roots -join '; ')" } + if (-not $found) { Write-Host "No 'registry.npmjs.org' dirs under: $($searchRoots -join '; ')" } Write-Host "===== end CFSClean diagnostic =====" # >>> END TEMPORARY CFSClean DIAGNOSTIC <<< From 01a5c9369af3fc150f33dbea5332824fa8941875 Mon Sep 17 00:00:00 2001 From: "Gavin Barron (from Dev Box)" Date: Wed, 19 Aug 2026 18:43:59 -0700 Subject: [PATCH 4/6] ci: onboard PowerShell V2 Build to network isolation enforcement (CFSClean) Revert the exploratory diagnostic + generation-disable changes; keep only the network isolation settings. Enforce mode with policy Good,GitHub,Npm,NuGet,PowershellGallery,CFSClean,CFSClean3 onboards the pipeline to 1ES network isolation for CFSClean/SFI compliance. Validated on branch build 234324: all policies (CFSClean, CFSClean2, CFSClean3, Default Deny) reported COMPLIANT and the build succeeded. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0 --- .azure-pipelines/ci-build.yml | 65 +++++++++---------- .../common-templates/install-tools.yml | 30 --------- 2 files changed, 31 insertions(+), 64 deletions(-) diff --git a/.azure-pipelines/ci-build.yml b/.azure-pipelines/ci-build.yml index c595fd371d3..81f5338d46b 100644 --- a/.azure-pipelines/ci-build.yml +++ b/.azure-pipelines/ci-build.yml @@ -51,11 +51,12 @@ extends: template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates parameters: pool: $(BuildAgent) - # TEMP (CFS npmjs diagnostic): enforce network isolation with the target policy set so we can - # see exactly what breaks under enforcement. Revert before merge. + # Onboard to 1ES network isolation enforcement for CFSClean / SFI compliance. Enforce mode with an + # allowlist for the package ecosystems this build uses so it resolves from approved feeds while + # non-allowlisted public egress is blocked. settings: networkIsolationMode: Enforce - networkIsolationPolicy: Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3 + networkIsolationPolicy: Good,GitHub,Npm,NuGet,PowershellGallery,CFSClean,CFSClean3 sdl: binskim: enabled: false @@ -111,38 +112,34 @@ extends: git submodule update --init --recursive - template: .azure-pipelines/common-templates/install-tools.yml@self - template: .azure-pipelines/common-templates/security-pre-checks.yml@self + + - template: .azure-pipelines/generation-templates/authentication-module.yml@self + parameters: + Test: ${{ parameters.Test }} + Pack: ${{ parameters.Pack }} + Sign: ${{ parameters.Sign }} - # >>> TEMP (CFS npmjs diagnostic): generation + downstream steps disabled to speed up the - # exploratory build. The npmjs egress happens in install-tools.yml (Rush Build) above, so we - # do not need module generation to reproduce it. Revert before merge. <<< - # - template: .azure-pipelines/generation-templates/authentication-module.yml@self - # parameters: - # Test: ${{ parameters.Test }} - # Pack: ${{ parameters.Pack }} - # Sign: ${{ parameters.Sign }} - # - # - template: .azure-pipelines/generation-templates/workload-modules.yml@self - # parameters: - # Test: ${{ parameters.Test }} - # Pack: ${{ parameters.Pack }} - # Sign: ${{ parameters.Sign }} - # - # - template: .azure-pipelines/generation-templates/meta-module.yml@self - # parameters: - # Test: ${{ parameters.Test }} - # Pack: ${{ parameters.Pack }} - # Sign: ${{ parameters.Sign }} - # - # - template: .azure-pipelines/common-templates/guardian-analyzer.yml@self - # - # - ${{ if and(eq(parameters.Pack, true), eq(parameters.Sign, true)) }}: - # - template: .azure-pipelines/common-templates/esrp/codesign-nuget.yml@self - # parameters: - # FolderPath: "$(Build.ArtifactStagingDirectory)" - # Pattern: "Microsoft.Graph*.nupkg" - # - # - template: .azure-pipelines/common-templates/security-post-checks.yml@self - # >>> END TEMP generation disable <<< + - template: .azure-pipelines/generation-templates/workload-modules.yml@self + parameters: + Test: ${{ parameters.Test }} + Pack: ${{ parameters.Pack }} + Sign: ${{ parameters.Sign }} + + - template: .azure-pipelines/generation-templates/meta-module.yml@self + parameters: + Test: ${{ parameters.Test }} + Pack: ${{ parameters.Pack }} + Sign: ${{ parameters.Sign }} + + - template: .azure-pipelines/common-templates/guardian-analyzer.yml@self + + - ${{ if and(eq(parameters.Pack, true), eq(parameters.Sign, true)) }}: + - template: .azure-pipelines/common-templates/esrp/codesign-nuget.yml@self + parameters: + FolderPath: "$(Build.ArtifactStagingDirectory)" + Pattern: "Microsoft.Graph*.nupkg" + + - template: .azure-pipelines/common-templates/security-post-checks.yml@self - ${{ if and(eq(parameters.Pack, true), eq(parameters.Sign, true)) }}: - stage: Deploy_to_ACR displayName: Deploy PowerShell packages to ACR diff --git a/.azure-pipelines/common-templates/install-tools.yml b/.azure-pipelines/common-templates/install-tools.yml index b31613dea89..c1f65040840 100644 --- a/.azure-pipelines/common-templates/install-tools.yml +++ b/.azure-pipelines/common-templates/install-tools.yml @@ -129,36 +129,6 @@ steps: npx --no-install rush install if ($LASTEXITCODE -ne 0) { throw "rush install failed with exit code $LASTEXITCODE" } - - # >>> TEMPORARY CFSClean DIAGNOSTIC (revert before merge) <<< - # The 2x registry.npmjs.org egress are metadata (packument) requests, not tarball - # downloads (the re-resolved lockfile has 0 npmjs URLs). pnpm caches packument metadata - # under /metadata(-vN)//, so listing the npmjs host folder - # names exactly which package(s) pnpm queried from public npm. - $tempLock = "common/temp/pnpm-lock.yaml" - if (Test-Path $tempLock) { - Write-Host "===== CFSClean diagnostic: npmjs.org tarball resolutions in $tempLock =====" - $hits = Select-String -Path $tempLock -Pattern 'registry\.npmjs\.(org|com)' -Context 4,0 - if ($hits) { $hits | ForEach-Object { $_.Context.PreContext + $_.Line | ForEach-Object { Write-Host $_ } ; Write-Host "----" } } - else { Write-Host "No registry.npmjs.org tarball URLs found in the re-resolved temp lockfile." } - } - Write-Host "===== CFSClean diagnostic: pnpm metadata cache entries from registry.npmjs.org =====" - Write-Host "--- transformed common/temp/.npmrc registry lines ---" - if (Test-Path "common/temp/.npmrc") { Select-String -Path "common/temp/.npmrc" -Pattern 'registry' | ForEach-Object { Write-Host $_.Line } } - $searchRoots = @("$env:LOCALAPPDATA", "$env:APPDATA", "$env:USERPROFILE\.rush", "$env:USERPROFILE\.pnpm-store", "$env:USERPROFILE\.cache", "common/temp") | Where-Object { $_ -and (Test-Path $_) } | Select-Object -Unique - $found = $false - foreach ($root in $searchRoots) { - $dirs = Get-ChildItem -Path $root -Recurse -Directory -Filter 'registry.npmjs.org' -ErrorAction SilentlyContinue -Depth 8 - foreach ($d in $dirs) { - $found = $true - Write-Host "npmjs metadata/cache dir: $($d.FullName)" - Get-ChildItem -Path $d.FullName -Recurse -File -ErrorAction SilentlyContinue | Select-Object -First 80 | ForEach-Object { Write-Host " $($_.FullName.Substring($d.FullName.Length))" } - } - } - if (-not $found) { Write-Host "No 'registry.npmjs.org' dirs under: $($searchRoots -join '; ')" } - Write-Host "===== end CFSClean diagnostic =====" - # >>> END TEMPORARY CFSClean DIAGNOSTIC <<< - npx --no-install rush link if ($LASTEXITCODE -ne 0) { throw "rush link failed with exit code $LASTEXITCODE" } npx --no-install rush rebuild From 9d7ca0acbdcc18a2ee253c03a50bbf7ad99ca041 Mon Sep 17 00:00:00 2001 From: "Gavin Barron (from Dev Box)" Date: Wed, 19 Aug 2026 18:59:39 -0700 Subject: [PATCH 5/6] ci: drop Npm from network isolation policy (block public npmjs) Removes Npm from the allowlist so public registry.npmjs.org is blocked under enforcement. Validated in build 234324: build succeeds and all CFSClean tiers report COMPLIANT with npmjs blocked. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0 --- .azure-pipelines/ci-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.azure-pipelines/ci-build.yml b/.azure-pipelines/ci-build.yml index 81f5338d46b..95d09b92252 100644 --- a/.azure-pipelines/ci-build.yml +++ b/.azure-pipelines/ci-build.yml @@ -56,7 +56,7 @@ extends: # non-allowlisted public egress is blocked. settings: networkIsolationMode: Enforce - networkIsolationPolicy: Good,GitHub,Npm,NuGet,PowershellGallery,CFSClean,CFSClean3 + networkIsolationPolicy: Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3 sdl: binskim: enabled: false From b171e2cf54ea4f62209e2d93d8ae42c47c5a830c Mon Sep 17 00:00:00 2001 From: "Gavin Barron (from Dev Box)" Date: Wed, 19 Aug 2026 19:03:24 -0700 Subject: [PATCH 6/6] ci: onboard Weekly (221) and Command-Metadata-Refresh (663) to network isolation enforcement Apply the same network isolation settings as ci-build.yml (187): Enforce mode with policy Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3. 663 previously set networkIsolationPolicy: Permissive; this switches it to enforcement. All three pipelines share install-tools.yml, so the same CFSClean posture applies. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0 --- .azure-pipelines/command-metadata-refresh.yml | 6 +++++- .azure-pipelines/weekly-generation.yml | 6 ++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/.azure-pipelines/command-metadata-refresh.yml b/.azure-pipelines/command-metadata-refresh.yml index 801e7ebd72b..cfa6f32361c 100644 --- a/.azure-pipelines/command-metadata-refresh.yml +++ b/.azure-pipelines/command-metadata-refresh.yml @@ -58,8 +58,12 @@ extends: template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates parameters: pool: $(BuildAgent) + # Onboard to 1ES network isolation enforcement for CFSClean / SFI compliance. Enforce mode with an + # allowlist for the package ecosystems this build uses so it resolves from approved feeds while + # non-allowlisted public egress is blocked. settings: - networkIsolationPolicy: Permissive + networkIsolationMode: Enforce + networkIsolationPolicy: Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3 sdl: binskim: enabled: false diff --git a/.azure-pipelines/weekly-generation.yml b/.azure-pipelines/weekly-generation.yml index 6be0893c0c6..e859bc415c8 100644 --- a/.azure-pipelines/weekly-generation.yml +++ b/.azure-pipelines/weekly-generation.yml @@ -61,6 +61,12 @@ extends: template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates parameters: pool: $(BuildAgent) + # Onboard to 1ES network isolation enforcement for CFSClean / SFI compliance. Enforce mode with an + # allowlist for the package ecosystems this build uses so it resolves from approved feeds while + # non-allowlisted public egress is blocked. + settings: + networkIsolationMode: Enforce + networkIsolationPolicy: Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3 sdl: binskim: enabled: false