Add CFSClean enforcement

cli/azd/extensions/microsoft.azd.demo/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Release History
 
+## 0.7.2 (2026-07-16)
+
+- Simple test release of extension, with no changes.
+
 ## 0.7.1 (2026-07-14)
 
 - Simple test release of extension, with no changes.

cli/azd/extensions/microsoft.azd.demo/extension.yaml

@@ -4,7 +4,7 @@ namespace: demo
 displayName: Demo Extension
 description: This extension provides examples of the azd extension framework.
 usage: azd demo <command> [options]
-version: 0.7.1
+version: 0.7.2
 language: go
 capabilities:
   - custom-commands

cli/azd/extensions/microsoft.azd.demo/version.txt

@@ -1 +1 @@
-0.7.1
+0.7.2

eng/common/pipelines/templates/steps/maven-authenticate.yml

@@ -0,0 +1,17 @@
+parameters:
+  SourceDirectory: $(Build.SourcesDirectory)
+
+steps:
+  # Copy mirror settings to default Maven location so all requests go through CFS
+  - pwsh: |
+      $m2Dir = if ($env:USERPROFILE) { "$env:USERPROFILE\.m2" } else { "$HOME/.m2" }
+      New-Item -ItemType Directory -Force -Path $m2Dir | Out-Null
+      Copy-Item -Path "${{ parameters.SourceDirectory }}/eng/settings.xml" -Destination "$m2Dir/settings.xml"
+    displayName: "Setup Maven mirror settings"
+
+  # Authenticate with Azure Artifacts feeds
+  # MavenAuthenticate adds <server> entries to ~/.m2/settings.xml matching mirror id 'azure-sdk-for-java'
+  - task: MavenAuthenticate@0
+    displayName: "Maven Authenticate"
+    inputs:
+      artifactsFeeds: "azure-sdk-for-java"

eng/common/pipelines/templates/steps/pypi-auth-dev-feed.yml

@@ -0,0 +1,49 @@
+parameters:
+  DevFeedName: "public/azure-sdk-for-python"
+  EnableTwineAuth: true
+  EnablePipAuth: true
+  EnableUvAuth: true
+
+steps:
+  - pwsh: |
+      # For safety default to publishing to the private feed.
+      # Publish to https://dev.azure.com/azure-sdk/internal/_packaging?_a=feed&feed=azure-sdk-for-python-pr
+      $devopsFeedName = 'internal/azure-sdk-for-python-pr'
+      if (-not ('$(Build.Repository.Name)').EndsWith('-pr')) {
+        # Publish to https://dev.azure.com/azure-sdk/public/_packaging?_a=feed&feed=azure-sdk-for-python
+        $devopsFeedName = '${{ parameters.DevFeedName }}'
+      }
+      echo "##vso[task.setvariable variable=DevFeedName]$devopsFeedName"
+      echo "Using DevopsFeed = $devopsFeedName"
+    displayName: Setup DevOpsFeedName
+
+  - ${{ if eq(parameters.EnableTwineAuth, true) }}:
+      - task: TwineAuthenticate@0
+        displayName: "Twine Authenticate to feed"
+        inputs:
+          artifactFeeds: $(DevFeedName)
+
+  - ${{ if eq(parameters.EnablePipAuth, true) }}:
+      - task: PipAuthenticate@1
+        displayName: "Pip Authenticate to feed"
+        inputs:
+          artifactFeeds: $(DevFeedName)
+          onlyAddExtraIndex: false
+
+  - ${{ if eq(parameters.EnableUvAuth, true) }}:
+      - pwsh: |
+          if ($env:PIP_INDEX_URL) {
+            Write-Host "Found pip index URL: $($env:PIP_INDEX_URL)"
+            # UV_DEFAULT_INDEX is the canonical replacement for the deprecated UV_INDEX_URL (uv 0.4.23+).
+            # PIP_INDEX_URL is set by PipAuthenticate@1 and contains embedded credentials, which uv
+            # will use for Basic auth against the ADO feed (and its PyPI upstream) per astral-sh/uv#12651.
+            Write-Host "##vso[task.setvariable variable=UV_DEFAULT_INDEX]$($env:PIP_INDEX_URL)"
+            # Disable keyring so uv uses the URL-embedded credentials directly.
+            Write-Host "##vso[task.setvariable variable=UV_KEYRING_PROVIDER]disabled"
+          } else {
+            Write-Host "##[warning]PIP_INDEX_URL not set - uv will fall back to public PyPI."
+          }
+          # Force any managed Python downloads to go directly to GitHub releases
+          # rather than the default CDN (releases.astral.sh).
+          Write-Host "##vso[task.setvariable variable=UV_PYTHON_INSTALL_MIRROR]https://github.com/astral-sh/python-build-standalone/releases/download"
+        displayName: "Configure UV Authentication"

eng/pipelines/templates/jobs/build-cli.yml

@@ -35,6 +35,9 @@ jobs:
     timeoutInMinutes: 180
     steps:
       - checkout: self
+
+      - template: /eng/common/pipelines/templates/steps/maven-authenticate.yml
+
       - template: /eng/pipelines/templates/steps/setup-go.yml
 
       - template: /eng/pipelines/templates/steps/set-cli-version-cd.yml

eng/pipelines/templates/stages/1es-redirect.yml

@@ -32,7 +32,7 @@ extends:
           enabled: true
     settings:
       skipBuildTagsForGitHubPullRequests: true
-      networkIsolationPolicy: Permissive
+      networkIsolationPolicy: Permissive, CFSClean
     sdl:
       # Turn off the build warnings caused by disabling some sdl checks
       createAdoIssuesForJustificationsForDisablement: false

eng/pipelines/templates/stages/build-and-test.yml

@@ -158,6 +158,8 @@ stages:
         steps:
           - checkout: self
 
+          - template: /eng/common/pipelines/templates/steps/pypi-auth-dev-feed.yml
+
           - template: /eng/pipelines/templates/steps/setup-go.yml
 
           - template: /eng/pipelines/templates/steps/set-cli-version-cd.yml

eng/pipelines/templates/steps/build-msi.yml

@@ -14,6 +14,8 @@ steps:
     displayName: Restore NuGet packages
     inputs:
       restoreSolution: cli/installer/windows.sln
+      feedsToUse: select
+      vstsFeed: 'public/azure-sdk-for-net'
 
   - ${{ if eq(parameters.ShouldBuildForRelease, 'true') }}:
     - pwsh: |

eng/settings.xml

@@ -0,0 +1,13 @@
+<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
+                        https://maven.apache.org/xsd/settings-1.0.0.xsd">
+  <mirrors>
+    <mirror>
+      <id>azure-sdk-for-java</id>
+      <name>Azure Artifacts Maven Mirror</name>
+      <url>https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-java/maven/v1</url>
+      <mirrorOf>external:*</mirrorOf>
+    </mirror>
+  </mirrors>
+</settings>