build: onboard npm restores to CFS - #462
Merged
Merged
Conversation
Route repository dependency restores through the azfunc public Central Feed Service feed and authenticate each reusable Azure Pipelines npm path. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 71244b0f-e67a-45fc-8442-4a7b079bfe2c
Swapnil Nagar (swapnil-nagar)
approved these changes
Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@azure).npmrcbefore every reusable Azure Pipelines npm execution pathAudit
The repository has one npm project and no workspaces. Its resolved production graph contains
@azure/functions-extensions-baseandcookie, so@azureis the only production scope requiring an explicit mapping. All repository pipeline definitions, templates, scripts, global-install paths, and packaging inputs were reviewed. There are no NuGet, pip, uv, global npm install, or sudo npm restore paths to migrate. Lockfile URLs remain unchanged. The config contains noalways-auth,replace-registry-host, or credentials.Validation
npm ci --loglevel=httpfrom a truly empty cache under a path containing spacesregistry.npmjs.orgrequests and zero HTTP 401 responsesnpm pack --dry-run, reproduced the pipeline-staged package, and validated the release script against a quoted drop path containing spaces.npmrc, lockfiles, credentials, pipeline files, tests, and build scripts are absent from the 96-file packageCaveats and lessons
The feed requires authentication even for the public upstream route; local validation used an ephemeral user config outside the repository, while Azure Pipelines uses
npmAuthenticate@0. TheNpm@1publish task intentionally retains its existing npm publishing endpoint because it publishes the customer package rather than restoring dependencies. A default CFS registry handles unscoped and development dependencies, while the explicit scope mapping is derived only from the complete production graph.