ci: onboard PowerShell pipelines (187/221/663) to network isolation enforcement (CFSClean) - #3732
Merged
Ramses Sanchez-Hernandez (ramsessanchez) merged 7 commits intoAug 20, 2026
Conversation
After `rush install`, print the entries in the re-resolved common/temp/pnpm-lock.yaml that resolved to registry.npmjs.org, to identify exactly which package(s) egress to public npm under 1ES network isolation. To be reverted once the culprits are identified. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
…js diagnostic Enforce networkIsolationMode with policy Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3 (deliberately omitting Npm) so public registry.npmjs.org egress is blocked and the failing pnpm fetch names the culprit package. Generation/downstream steps disabled to keep the build fast. To be reverted before merge. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
…Clean) Revert the exploratory diagnostic + generation-disable changes; keep only the network isolation settings. Enforce mode with policy Good,GitHub,Npm,NuGet,PowershellGallery,CFSClean,CFSClean3 onboards the pipeline to 1ES network isolation for CFSClean/SFI compliance. Validated on branch build 234324: all policies (CFSClean, CFSClean2, CFSClean3, Default Deny) reported COMPLIANT and the build succeeded. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
Gavin Barron (gavinbarron)
changed the title
Removes Npm from the allowlist so public registry.npmjs.org is blocked under enforcement. Validated in build 234324: build succeeds and all CFSClean tiers report COMPLIANT with npmjs blocked. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
…k isolation enforcement Apply the same network isolation settings as ci-build.yml (187): Enforce mode with policy Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3. 663 previously set networkIsolationPolicy: Permissive; this switches it to enforcement. All three pipelines share install-tools.yml, so the same CFSClean posture applies. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
Gavin Barron (gavinbarron)
changed the title
Adrian (adrian05-ms)
approved these changes
Aug 20, 2026
Ramses Sanchez-Hernandez (ramsessanchez)
enabled auto-merge (squash)
August 20, 2026 21:43
Ramses Sanchez-Hernandez (ramsessanchez)
merged commit Aug 20, 2026
375a2e3
into
main
2 of 4 checks passed
Ramses Sanchez-Hernandez (ramsessanchez)
deleted the
gavinbarron/cfs-npmjs-diagnostic
branch
August 20, 2026 21:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Onboard the three
msgraph-sdk-powershellpipelines to 1ES network isolation enforcement for CFSClean / SFI compliance:.azure-pipelines/ci-build.yml.azure-pipelines/weekly-generation.yml.azure-pipelines/command-metadata-refresh.yml(wasPermissive)Why
These pipelines ran under the Permissive default, logging (not blocking) public-feed egress — a residual 2×
registry.npmjs.org(opportunistic pnpm metadata request) keptPermissiveCFSClean = False. Enforcement blocks non-allowlisted public egress (including public npm) and moves them to a compliant posture. All three sharecommon-templates/install-tools.yml, so the same CFSClean behavior applies.Validation
Proven on branch build 234324 (def 187, this exact policy): Stop Network Isolation blocked
registry.npmjs.org, the build succeeded (pnpm resolves everything from the private feed — the npmjs egress is non-essential), and all policies reported COMPLIANT:CFSClean,CFSClean2,CFSClean3, and Default Deny.Notes
settingsblocks. The exploratory diagnostic + generation-disable changes have been reverted.Npmis intentionally not in the allowlist, so public npmjs is blocked (validated to still build cleanly).