From a04bd0595190f0cac6e2d0cb3662ecc8eeced844 Mon Sep 17 00:00:00 2001 From: "Gavin Barron (from Dev Box)" Date: Thu, 6 Aug 2026 10:41:41 -0700 Subject: [PATCH] Force autorest cache pre-population onto the private npm feed (CFSClean) PrePopulateAutorestCache.ps1 runs 'npm install --prefix ' for @autorest/core and @autorest/modelerfour. With --prefix, npm did not honor the registry/auth in ~/.npmrc and reached registry.npmjs.org directly (2 hits/build) - the residual CFSClean violation on pipeline 187 after the autorest --skip-upgrade-check fix (#3696). Pass --userconfig and --registry explicitly (read from the authenticated ~/.npmrc that install-tools.yml produced) so both installs use the PowerShell_V2_Build private feed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188 --- tools/Utilities/PrePopulateAutorestCache.ps1 | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/tools/Utilities/PrePopulateAutorestCache.ps1 b/tools/Utilities/PrePopulateAutorestCache.ps1 index a02d3568e6..4c8e778cc0 100644 --- a/tools/Utilities/PrePopulateAutorestCache.ps1 +++ b/tools/Utilities/PrePopulateAutorestCache.ps1 @@ -22,6 +22,21 @@ $extensions = @( "@autorest/modelerfour@4.24.3" ) +# Force these installs onto the authenticated private feed. `npm install --prefix ` does not +# reliably pick up the registry/auth from ~/.npmrc (it was observed hitting registry.npmjs.org +# directly, breaking CFSClean network isolation), so pass --userconfig and --registry explicitly, +# derived from the authenticated ~/.npmrc that install-tools.yml produced. +$npmFeedArgs = @() +$userNpmrc = Join-Path $env:USERPROFILE ".npmrc" +if (Test-Path $userNpmrc) { + $npmFeedArgs += @('--userconfig', $userNpmrc) + $regLine = Select-String -Path $userNpmrc -Pattern '^registry=' | Select-Object -First 1 + if ($regLine) { $npmFeedArgs += @('--registry', ($regLine.Line -replace '^registry=', '').Trim()) } +} +else { + Write-Host "WARNING: ~/.npmrc not found; npm install may reach the public registry (CFSClean risk)." +} + foreach ($ext in $extensions) { $parts = $ext -split '@(?=[^@]+$)' # split on last @ $pkg = $parts[0] @@ -36,7 +51,8 @@ foreach ($ext in $extensions) { New-Item -ItemType Directory -Force -Path $cacheDir | Out-Null Write-Host "Pre-installing $ext into $cacheDir" - npm install $ext --prefix $cacheDir + npm install $ext --prefix $cacheDir @npmFeedArgs if ($LASTEXITCODE -ne 0) { throw "Failed to pre-install $ext (exit $LASTEXITCODE)" } Write-Host "Done: $ext" } +