From 68ed4e8e3e6a83526b311a9d6526c4b2738eb0a4 Mon Sep 17 00:00:00 2001
From: Fabio Cavalcante <facaval@microsoft.com>
Date: Fri, 31 Jul 2026 10:08:50 -0700
Subject: [PATCH 1/2] Route NuGet restores through CFS

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../workflows/azure-functions-smoke-tests.yml |  3 --
 .github/workflows/codeQL.yml                  |  4 +--
 .github/workflows/validate-build.yml          |  8 ++---
 azure-pipelines-release.yml                   |  5 ++-
 eng/templates/build.yml                       |  5 ++-
 nuget.config                                  |  9 +++--
 .../run-smoketests.ps1                        | 36 ++++++++++++++++---
 7 files changed, 53 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/azure-functions-smoke-tests.yml b/.github/workflows/azure-functions-smoke-tests.yml
index d593cf7a..37c4c5f7 100644
--- a/.github/workflows/azure-functions-smoke-tests.yml
+++ b/.github/workflows/azure-functions-smoke-tests.yml
@@ -31,9 +31,6 @@ jobs:
       with:
         global-json-file: global.json
 
-    - name: Restore dependencies
-      run: dotnet restore test/AzureFunctionsSmokeTests/AzureFunctionsSmokeTests.csproj
-
     - name: Run smoke tests
       run: |
         cd test/AzureFunctionsSmokeTests
diff --git a/.github/workflows/codeQL.yml b/.github/workflows/codeQL.yml
index 5c190824..790fc63d 100644
--- a/.github/workflows/codeQL.yml
+++ b/.github/workflows/codeQL.yml
@@ -59,10 +59,10 @@ jobs:
         global-json-file: global.json
 
     - name: Restore dependencies
-      run: dotnet restore $solution
+      run: dotnet restore "$env:solution" --configfile "$env:GITHUB_WORKSPACE\nuget.config"
 
     - name: Build
-      run: dotnet build $solution #--configuration $config #--no-restore -p:FileVersionRevision=$GITHUB_RUN_NUMBER -p:ContinuousIntegrationBuild=true
+      run: dotnet build "$env:solution" --no-restore -p:FileVersionRevision=$env:GITHUB_RUN_NUMBER -p:ContinuousIntegrationBuild=true
 
     # Run CodeQL analysis
     - name: Perform CodeQL Analysis
diff --git a/.github/workflows/validate-build.yml b/.github/workflows/validate-build.yml
index 100ff0ed..25568d15 100644
--- a/.github/workflows/validate-build.yml
+++ b/.github/workflows/validate-build.yml
@@ -47,16 +47,16 @@ jobs:
         global-json-file: global.json
 
     - name: Restore dependencies
-      run: dotnet restore $env:solution
+      run: dotnet restore "$env:solution" --configfile "$env:GITHUB_WORKSPACE\nuget.config"
 
     - name: Build
-      run: dotnet build $env:solution --configuration $env:config --no-restore -p:FileVersionRevision=$env:GITHUB_RUN_NUMBER
+      run: dotnet build "$env:solution" --configuration $env:config --no-restore -p:FileVersionRevision=$env:GITHUB_RUN_NUMBER
 
     - name: Test
-      run: dotnet test $env:solution --configuration $env:config --no-build --verbosity normal
+      run: dotnet test "$env:solution" --configuration $env:config --no-build --no-restore --verbosity normal
 
     - name: Pack
-      run: dotnet pack $env:solution --configuration $env:config --no-build
+      run: dotnet pack "$env:solution" --configuration $env:config --no-build --no-restore
 
     - name: Upload
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/azure-pipelines-release.yml b/azure-pipelines-release.yml
index 60abd025..3bfb6e83 100644
--- a/azure-pipelines-release.yml
+++ b/azure-pipelines-release.yml
@@ -42,6 +42,9 @@ steps:
     useGlobalJson: true
 
 # Start by restoring all the dependencies. This needs to be its own task.
+- task: NuGetAuthenticate@1
+  displayName: Authenticate NuGet feeds
+
 - task: DotNetCoreCLI@2
   displayName: Restore
   inputs:
@@ -105,7 +108,7 @@ steps:
   inputs:
     command: custom
     custom: pack
-    arguments: --no-build $(build_args) $(pack_binlog)
+    arguments: --no-build --no-restore $(build_args) $(pack_binlog)
     projects: $(project)
 
 # Digitally sign all the nuget packages with the Microsoft certificate.
diff --git a/eng/templates/build.yml b/eng/templates/build.yml
index 4b6112e0..fd163993 100644
--- a/eng/templates/build.yml
+++ b/eng/templates/build.yml
@@ -44,6 +44,9 @@ jobs:
             useGlobalJson: true
 
         # Start by restoring all the dependencies. This needs to be its own task.
+        - task: NuGetAuthenticate@1
+          displayName: Authenticate NuGet feeds
+
         - task: DotNetCoreCLI@2
           displayName: Restore
           inputs:
@@ -75,7 +78,7 @@ jobs:
           inputs:
             command: custom
             custom: pack
-            arguments: --no-build $(build_args) $(pack_binlog)
+            arguments: --no-build --no-restore $(build_args) $(pack_binlog)
             projects: $(project)
 
         - template: ci/sign-files.yml@eng
diff --git a/nuget.config b/nuget.config
index 6f509391..be7fc539 100644
--- a/nuget.config
+++ b/nuget.config
@@ -1,7 +1,12 @@
 <?xml version="1.0" encoding="utf-8"?>
 <configuration>
   <packageSources>
-    <clear/>
-    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
+    <clear />
+    <add key="upstream-public" value="https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/nuget/v3/index.json" protocolVersion="3" />
   </packageSources>
+  <packageSourceMapping>
+    <packageSource key="upstream-public">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
 </configuration>
\ No newline at end of file
diff --git a/test/AzureFunctionsSmokeTests/run-smoketests.ps1 b/test/AzureFunctionsSmokeTests/run-smoketests.ps1
index 542132b6..dab3de72 100644
--- a/test/AzureFunctionsSmokeTests/run-smoketests.ps1
+++ b/test/AzureFunctionsSmokeTests/run-smoketests.ps1
@@ -30,6 +30,7 @@ $ErrorActionPreference = "Stop"
 $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
 $projectDir = $scriptDir
 $publishDir = Join-Path $projectDir "publish"
+$nugetConfig = Join-Path $scriptDir "..\..\nuget.config"
 
 Write-Host "=== Azure Functions Smoke Test Runner ===" -ForegroundColor Cyan
 Write-Host ""
@@ -63,9 +64,27 @@ try {
     Cleanup
     Write-Host ""
     
-    # Step 1: Build the project
-    Write-Host "Step 1: Building the Azure Functions project..." -ForegroundColor Green
-    dotnet build $projectDir -c Release
+    # Step 1: Restore and build the project
+    Write-Host "Step 1: Restoring and building the Azure Functions project..." -ForegroundColor Green
+    $restoreArguments = @(
+        "restore"
+        $projectDir
+        "--configfile"
+        $nugetConfig
+    )
+    dotnet @restoreArguments
+    if ($LASTEXITCODE -ne 0) {
+        throw "Restore failed with exit code $LASTEXITCODE"
+    }
+
+    $buildArguments = @(
+        "build"
+        $projectDir
+        "-c"
+        "Release"
+        "--no-restore"
+    )
+    dotnet @buildArguments
     if ($LASTEXITCODE -ne 0) {
         throw "Build failed with exit code $LASTEXITCODE"
     }
@@ -77,7 +96,16 @@ try {
     if (Test-Path $publishDir) {
         Remove-Item $publishDir -Recurse -Force
     }
-    dotnet publish $projectDir -c Release -o $publishDir
+    $publishArguments = @(
+        "publish"
+        $projectDir
+        "-c"
+        "Release"
+        "-o"
+        $publishDir
+        "--no-restore"
+    )
+    dotnet @publishArguments
     if ($LASTEXITCODE -ne 0) {
         throw "Publish failed with exit code $LASTEXITCODE"
     }

From c1aac68293ecfa863241fdb397093dc44b139a98 Mon Sep 17 00:00:00 2001
From: Fabio Cavalcante <facaval@microsoft.com>
Date: Fri, 31 Jul 2026 10:19:33 -0700
Subject: [PATCH 2/2] Handle cold CodeQL runtime restore

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/codeQL.yml                     | 9 +++++++--
 test/AzureFunctionsSmokeTests/run-smoketests.ps1 | 3 ++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeQL.yml b/.github/workflows/codeQL.yml
index 790fc63d..251cf1f7 100644
--- a/.github/workflows/codeQL.yml
+++ b/.github/workflows/codeQL.yml
@@ -53,8 +53,13 @@ jobs:
       with:
         submodules: true
 
-    - name: Setup .NET
-      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+    - name: Setup .NET 6.0
+      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+      with:
+        dotnet-version: '6.0.x'
+
+    - name: Setup .NET from global.json
+      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
       with:
         global-json-file: global.json
 
diff --git a/test/AzureFunctionsSmokeTests/run-smoketests.ps1 b/test/AzureFunctionsSmokeTests/run-smoketests.ps1
index dab3de72..ef0e5aca 100644
--- a/test/AzureFunctionsSmokeTests/run-smoketests.ps1
+++ b/test/AzureFunctionsSmokeTests/run-smoketests.ps1
@@ -30,7 +30,8 @@ $ErrorActionPreference = "Stop"
 $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
 $projectDir = $scriptDir
 $publishDir = Join-Path $projectDir "publish"
-$nugetConfig = Join-Path $scriptDir "..\..\nuget.config"
+$repoRoot = Split-Path -Parent (Split-Path -Parent $scriptDir)
+$nugetConfig = Join-Path $repoRoot "nuget.config"
 
 Write-Host "=== Azure Functions Smoke Test Runner ===" -ForegroundColor Cyan
 Write-Host ""