From 3a2132334682c69a86160a5fee500db7e61accd3 Mon Sep 17 00:00:00 2001 From: "Gavin Barron (from Dev Box)" Date: Mon, 20 Jul 2026 09:12:46 -0700 Subject: [PATCH] Route Gradle dependency resolution through the CFS central package feed Adds a Gradle init script that redirects dependency and plugin resolution to the authenticated GraphDeveloperExperiences_Public Azure Artifacts feed, wired in via MavenAuthenticate + SYSTEM_ACCESSTOKEN (network isolation / CFS compliance). Requires a pipeline run to validate. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9bd6fe40-0d69-4e3f-927b-8628c0ab6d34 --- .azure-pipelines/ci-build.yml | 21 +++++++++-- .../network-isolation-feed.init.gradle | 37 +++++++++++++++++++ 2 files changed, 54 insertions(+), 4 deletions(-) create mode 100644 .azure-pipelines/network-isolation-feed.init.gradle diff --git a/.azure-pipelines/ci-build.yml b/.azure-pipelines/ci-build.yml index fd042f365..7db8b6a34 100644 --- a/.azure-pipelines/ci-build.yml +++ b/.azure-pipelines/ci-build.yml @@ -72,21 +72,34 @@ extends: Copy-Item $(downloadLocalProperties.secureFilePath) local.properties -Verbose displayName: Copy secring and 'local.properties' - - script: ./gradlew --no-daemon publishToMavenLocal -PmavenCentralPublishingEnabled=true -PmavenCentralSnapshotArtifactSuffix="" + - task: MavenAuthenticate@0 + displayName: Authenticate to Azure Artifacts feed (PAT-less) + inputs: + artifactsFeeds: 'GraphDeveloperExperiences_Public' + + - script: ./gradlew --no-daemon --init-script .azure-pipelines/network-isolation-feed.init.gradle publishToMavenLocal -PmavenCentralPublishingEnabled=true -PmavenCentralSnapshotArtifactSuffix="" displayName: Publish to local Maven for verification condition: contains(variables['build.sourceBranch'], 'refs/tags/v') + env: + SYSTEM_ACCESSTOKEN: $(System.AccessToken) - - script: ./gradlew --no-daemon publishToMavenLocal -PmavenCentralPublishingEnabled=true + - script: ./gradlew --no-daemon --init-script .azure-pipelines/network-isolation-feed.init.gradle publishToMavenLocal -PmavenCentralPublishingEnabled=true displayName: Publish to local Maven for verification condition: not(contains(variables['build.sourceBranch'], 'refs/tags/v')) + env: + SYSTEM_ACCESSTOKEN: $(System.AccessToken) - - script: ./gradlew --no-daemon publishMavenPublicationToADORepository -PmavenCentralPublishingEnabled=true -PmavenCentralSnapshotArtifactSuffix="" + - script: ./gradlew --no-daemon --init-script .azure-pipelines/network-isolation-feed.init.gradle publishMavenPublicationToADORepository -PmavenCentralPublishingEnabled=true -PmavenCentralSnapshotArtifactSuffix="" displayName: Publish to local Maven ADO for ESRP condition: contains(variables['build.sourceBranch'], 'refs/tags/v') + env: + SYSTEM_ACCESSTOKEN: $(System.AccessToken) - - script: ./gradlew --no-daemon publishMavenPublicationToADORepository -PmavenCentralPublishingEnabled=true + - script: ./gradlew --no-daemon --init-script .azure-pipelines/network-isolation-feed.init.gradle publishMavenPublicationToADORepository -PmavenCentralPublishingEnabled=true displayName: Publish to local Maven ADO for ESRP condition: not(contains(variables['build.sourceBranch'], 'refs/tags/v')) + env: + SYSTEM_ACCESSTOKEN: $(System.AccessToken) - pwsh: | $contents = Get-Content gradle.properties -Raw diff --git a/.azure-pipelines/network-isolation-feed.init.gradle b/.azure-pipelines/network-isolation-feed.init.gradle new file mode 100644 index 000000000..9654e3035 --- /dev/null +++ b/.azure-pipelines/network-isolation-feed.init.gradle @@ -0,0 +1,37 @@ +// Network-isolated CI (CFS): route ALL Gradle dependency and plugin resolution through the +// authenticated Azure Artifacts feed instead of public repositories (Maven Central / Gradle Plugin +// Portal). This feed is an upstream-mirroring feed, so it must have Maven Central configured as an +// upstream source (and the Gradle Plugin Portal upstream, for plugin resolution). +// +// Authentication uses the pipeline OAuth token exposed as SYSTEM_ACCESSTOKEN; the Project Collection +// Build Service identity must have at least Reader access to the feed. This init script is applied via +// `--init-script` from .azure-pipelines/ci-build.yml and is paired with the MavenAuthenticate@0 task. +import org.gradle.api.artifacts.dsl.RepositoryHandler +import org.gradle.api.credentials.HttpHeaderCredentials +import org.gradle.authentication.http.HttpHeaderAuthentication + +final String FEED_URL = 'https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public/maven/v1' +final String ACCESS_TOKEN = System.getenv('SYSTEM_ACCESSTOKEN') + +Closure applyFeed = { RepositoryHandler repositories -> + repositories.clear() + repositories.maven { repo -> + repo.url = FEED_URL + repo.credentials(HttpHeaderCredentials) { creds -> + creds.name = 'Authorization' + creds.value = "Bearer ${ACCESS_TOKEN}" + } + repo.authentication { container -> container.create('header', HttpHeaderAuthentication) } + } +} + +// Redirect plugin resolution (settings pluginManagement) to the feed. +settingsEvaluated { settings -> + applyFeed(settings.pluginManagement.repositories) +} + +// Redirect buildscript classpath + project dependency resolution for every project to the feed. +allprojects { project -> + applyFeed(project.buildscript.repositories) + applyFeed(project.repositories) +}