Look up published version via CFS feed instead of api.nuget.org (CFSClean) - #1086
Merged
Gavin Barron (gavinbarron) merged 1 commit intoAug 5, 2026
Merged
Conversation
…lean) The 'Validate updated version' gate in productionBuild.yml runs ValidateUpdatedNugetVersion.ps1, which Invoke-RestMethod's api.nuget.org directly (pwsh.exe -> api.nuget.org) - the sole CFSClean network-isolation violation on pipeline 197 (Dotnet Core Production). Parameterize the registrations base URL (default stays nuget.org for back-compat) and send SYSTEM_ACCESSTOKEN as a bearer token when set; point the pipeline step at the CFS feed's registrations2 endpoint (GraphDeveloperExperiences_Public, which upstreams nuget.org). Verified the feed returns the same latest version (4.0.1) so the gate is unchanged. Also broaden the graceful first-publish handling to HTTP 404 and fix the '&&' condition to '-and'. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188
Peter Ombwa (peombwa)
approved these changes
Aug 5, 2026
Gavin Barron (gavinbarron)
deleted the
gavinbarron/cfs-validate-version-197
branch
August 5, 2026 20:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fixes the sole CFSClean network-isolation violation on the
Dotnet Core Productionpipeline (definitionId 197): the release version-bump gate callsapi.nuget.orgdirectly.Why
Telemetry for the last run (build 230603) shows exactly one CFSClean violation —
pwsh.exe->api.nuget.orgin thebuildjob. It comes from theValidate updated versionstep, which runsscripts/ValidateUpdatedNugetVersion.ps1:This is a REST call (not a package restore) to read the latest published version.
dotnet restorein this repo is already CFS-clean; only this lookup egresses to nuget.org.Changes
scripts/ValidateUpdatedNugetVersion.ps1: add a-registrationsBaseUrlparameter (default stayshttps://api.nuget.org/v3/registration5-gz-semver2for back-compat), and sendAuthorization: Bearer $env:SYSTEM_ACCESSTOKENwhen set. Broaden the graceful "first publish" handling to HTTP 404, and fix the&&condition to-and.pipelines/productionBuild.yml(Validate updated versionstep): pass the CFS feed registrations endpoint (GraphDeveloperExperiences_Public, which upstreams nuget.org) and exposeSYSTEM_ACCESSTOKEN: $(System.AccessToken).Validation
Ran the modified script locally against the CFS feed: it authenticated, returned the same latest version (4.0.1) as nuget.org, and produced the identical gate result (version-bump error when csproj == published). No
api.nuget.orgegress.Relates to S360 KPI 527fb616-07aa-8198-6419-50d04ef1c2f3 (Vulnerability Management / 1ES network isolation).
Microsoft Reviewers: Open in CodeFlow