Stop autorest upgrade-check from egressing to npmjs (CFSClean)

[Gavin Barron (gavinbarron)]

What

Stops the residual CFSClean network-isolation violation on the PowerShell generation pipelines (187 PowerShell V2 Build, 221 Weekly PowerShell V2 Build, 663 Command-Metadata-Refresh): node.exe -> registry.npmjs.org during autorest generation.

Why

The repo already has a thorough private-feed npm setup (Configure-PrivateNpmFeed.ps1, install-tools.yml copying an authenticated .npmrc to ~/.npmrc, PrePopulateAutorestCache.ps1, and @autorest/modelerfour passed as a local --use: path). The PowerShell_V2_Build feed serves the autorest packages from itself (verified), so package downloads don't leak.

The residual egress is autorest core's upgrade check. In Azure/autorest, check-autorest-update.ts queries the public npm registry unless --skip-upgrade-check is set:

if ((await networkEnabled) && !args["skip-upgrade-check"]) {
  // isAutorestUpdateAvailable(...) -> hits registry.npmjs.org
}

The generation invocation in GenerateServiceModule.ps1 didn't set that flag, so every autorest run pinged npmjs to check for a newer @autorest/core.

Changes (tools/GenerateServiceModule.ps1)

• Add --skip-upgrade-check to the npx --no-install autorest ... command (gates the exact code path above).
• Set npm_config_registry from the authenticated ~/.npmrc before the call — belt-and-suspenders so any autorest npm-registry-fetch uses the private feed instead of defaulting to registry.npmjs.org. (No feed URL is hard-coded; it's read from the .npmrc that install-tools.yml already produced.)

Notes

• The pre-populate cache already covers the only two npm extensions autorest resolves (@autorest/core, @autorest/modelerfour), and the PowerShell generator is a local submodule (use: local path) — so no cache expansion was needed; the leak was purely the upgrade check.
• Separately, these pipelines also trip CFSClean2 on PowerShell Gallery (www/cdn.powershellgallery.com) — a looser tier, out of scope here.
• Needs a validation run on main post-merge to confirm the registry.npmjs.org egress is gone.

Relates to S360 KPI 527fb616-07aa-8198-6419-50d04ef1c2f3 (1ES network isolation).