From d90b700230ac61dbaa7331e9f8e52afea8eb61eb Mon Sep 17 00:00:00 2001
From: Fabio Cavalcante <facaval@microsoft.com>
Date: Fri, 31 Jul 2026 11:47:04 -0700
Subject: [PATCH] build: route Python installs through CFS

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 7c6baf8a-9215-4c43-acfd-eee1fdd29182
---
 eng/ci/official-build.yml                          |  2 --
 eng/ci/public-build.yml                            |  2 --
 eng/templates/jobs/build.yml                       |  9 +++++----
 eng/templates/jobs/ci-tests.yml                    | 13 +++++--------
 eng/templates/official/jobs/build-artifacts.yml    |  9 +++++----
 eng/templates/official/release/build-artifacts.yml |  9 +++++----
 6 files changed, 20 insertions(+), 24 deletions(-)

diff --git a/eng/ci/official-build.yml b/eng/ci/official-build.yml
index 8a6dcacd..d4f4e9a7 100644
--- a/eng/ci/official-build.yml
+++ b/eng/ci/official-build.yml
@@ -48,5 +48,3 @@ extends:
         dependsOn: Build
         jobs:
           - template: /eng/templates/jobs/ci-tests.yml@self
-            parameters:
-              artifactFeed: 'internal/PythonSDK_Internal_PublicPackages'
diff --git a/eng/ci/public-build.yml b/eng/ci/public-build.yml
index 6805c560..074d0eb9 100644
--- a/eng/ci/public-build.yml
+++ b/eng/ci/public-build.yml
@@ -48,5 +48,3 @@ extends:
         dependsOn: Build
         jobs:
           - template: /eng/templates/jobs/ci-tests.yml@self
-            parameters:
-              artifactFeed: 'public/PythonSDK_PublicPackages'
diff --git a/eng/templates/jobs/build.yml b/eng/templates/jobs/build.yml
index 9a43ea4a..08aa712d 100644
--- a/eng/templates/jobs/build.yml
+++ b/eng/templates/jobs/build.yml
@@ -16,16 +16,17 @@ jobs:
           PYTHON_VERSION: '3.14'
           
     steps:
+      - task: PipAuthenticate@1
+        displayName: 'Authenticate to CFS'
+        inputs:
+          artifactFeeds: 'public/upstream-public'
+          onlyAddExtraIndex: false
       - task: UsePythonVersion@0
         inputs:
           versionSpec: $(PYTHON_VERSION)
       - bash: |
           python --version
         displayName: 'Check python version'
-      - task: PipAuthenticate@1
-        displayName: 'Pip Authenticate'
-        inputs:
-          artifactFeeds: 'public/PythonSDK_PublicPackages'
       - bash: |
           python -m pip install -U pip
           python -m pip install build
diff --git a/eng/templates/jobs/ci-tests.yml b/eng/templates/jobs/ci-tests.yml
index c312c005..29323ddb 100644
--- a/eng/templates/jobs/ci-tests.yml
+++ b/eng/templates/jobs/ci-tests.yml
@@ -1,7 +1,3 @@
-parameters:
-  - name: artifactFeed
-    type: string
-
 jobs:
   - job: "TestPython"
     displayName: "Run Python SDK Unit Tests"
@@ -20,6 +16,11 @@ jobs:
           PYTHON_VERSION: '3.14'
           
     steps:
+      - task: PipAuthenticate@1
+        displayName: 'Authenticate to CFS'
+        inputs:
+          artifactFeeds: 'public/upstream-public'
+          onlyAddExtraIndex: false
       - task: UsePythonVersion@0
         inputs:
           versionSpec: $(PYTHON_VERSION)
@@ -27,10 +28,6 @@ jobs:
           VERSION=$(python -c "import re; content = open('azure/functions/__init__.py').read(); match = re.search(r\"__version__ = '(\d+)\.(\d+)\.(\d+).*'\", content); print(match.group(1)) if match else '1'")
           echo "##vso[task.setvariable variable=MAJOR_VERSION]$VERSION"
         displayName: 'Detect package version'
-      - task: PipAuthenticate@1
-        displayName: 'Pip Authenticate'
-        inputs:
-          artifactFeeds: ${{ parameters.artifactFeed }}
       - bash: |
           PYTHON_MAJOR=$(echo $(PYTHON_VERSION) | cut -d. -f1)
           PYTHON_MINOR=$(echo $(PYTHON_VERSION) | cut -d. -f2)
diff --git a/eng/templates/official/jobs/build-artifacts.yml b/eng/templates/official/jobs/build-artifacts.yml
index 12426c57..ab213eaf 100644
--- a/eng/templates/official/jobs/build-artifacts.yml
+++ b/eng/templates/official/jobs/build-artifacts.yml
@@ -15,16 +15,17 @@ jobs:
           artifactName: "azure-functions"
 
     steps:
+      - task: PipAuthenticate@1
+        displayName: 'Authenticate to CFS'
+        inputs:
+          artifactFeeds: 'public/upstream-public'
+          onlyAddExtraIndex: false
       - task: UsePythonVersion@0
         inputs:
           versionSpec: "3.11"
       - bash: |
           python --version
         displayName: 'Check python version'
-      - task: PipAuthenticate@1
-        displayName: 'Pip Authenticate'
-        inputs:
-          artifactFeeds: 'internal/PythonSDK_Internal_PublicPackages'
       - bash: |
           python -m pip install -U pip
           python -m pip install build
diff --git a/eng/templates/official/release/build-artifacts.yml b/eng/templates/official/release/build-artifacts.yml
index 67b5c47c..d05ec7ed 100644
--- a/eng/templates/official/release/build-artifacts.yml
+++ b/eng/templates/official/release/build-artifacts.yml
@@ -56,16 +56,17 @@ jobs:
               "https://$(GithubUser):$(GithubPat)@github.com/${{ parameters.githubOrg }}/${{ parameters.githubRepo }}.git" .
           displayName: 'Checkout ${{ parameters.releaseBranchPrefix }}/${{ parameters.libraryVersion }} branch'
 
+      - task: PipAuthenticate@1
+        displayName: 'Authenticate to CFS'
+        inputs:
+          artifactFeeds: 'public/upstream-public'
+          onlyAddExtraIndex: false
       - task: UsePythonVersion@0
         inputs:
           versionSpec: "${{ parameters.pythonVersion }}"
       - bash: |
           python --version
         displayName: 'Check python version'
-      - task: PipAuthenticate@1
-        displayName: 'Pip Authenticate'
-        inputs:
-          artifactFeeds: 'internal/PythonSDK_Internal_PublicPackages'
       - bash: |
           python -m pip install -U pip
           python -m pip install build