From 0309ed7dc2c9c4a0e19f0ef1577fc7e521361776 Mon Sep 17 00:00:00 2001 From: Anukrati Agrawal Date: Mon, 12 Oct 2026 12:18:45 -0700 Subject: [PATCH 1/3] Route validation npm requests through package proxy Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0f63ea4f-a16b-4fa3-b141-785aec89b5e4 --- .ado/variables/shared.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.ado/variables/shared.yml b/.ado/variables/shared.yml index 19af99d617c..aaa80313ec1 100644 --- a/.ado/variables/shared.yml +++ b/.ado/variables/shared.yml @@ -6,8 +6,9 @@ variables: NPM_CONFIG_YES: false NPM_CONFIG_CACHE: $(Agent.TempDirectory)/.npmCache - # Route npm/Yarn through the ms/react-native-public feed (npmjs upstream) on isolated agents - NPM_CONFIG_REGISTRY: https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/ + # Route npm through the anonymous proxy so PR and CI npx calls do not require feed authentication. + NPM_CONFIG_REGISTRY: https://packagefeedproxy.microsoft.io/npm/ + # Route Yarn through the ms/react-native-public feed (npmjs upstream) on isolated agents. YARN_NPM_REGISTRY_SERVER: https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/ # Stop React Native DevTools from fetching its standalone shell binary via DotSlash from a From 8d60868944b1d4795c60c9ffe42391c8a38433b0 Mon Sep 17 00:00:00 2001 From: Anukrati Agrawal Date: Mon, 12 Oct 2026 13:07:34 -0700 Subject: [PATCH 2/3] Document validation package registry routing Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0f63ea4f-a16b-4fa3-b141-785aec89b5e4 --- .ado/README.md | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/.ado/README.md b/.ado/README.md index fc0e66c2f48..e5e80b5c8dd 100644 --- a/.ado/README.md +++ b/.ado/README.md @@ -50,14 +50,15 @@ All repository resources pin `ref: refs/tags/release`. ## Package feed and network isolation ISS agents run under 1ES **Network Isolation**, which blocks egress to public CDNs. -The pipelines source packages only from the `ms/react-native-public` Azure Artifacts -feed and neutralize three background egress attempts that green builds would -otherwise hide: - -- **Feed registry:** `variables/shared.yml` points npm and Yarn at the - `ms/react-native-public` feed (`NPM_CONFIG_REGISTRY` / `YARN_NPM_REGISTRY_SERVER`). - On CI, `templates/auth-npm-feed.yml` mints a managed-identity token and writes it - to `~/.npmrc` and `~/.yarnrc.yml` before any install. +The pipelines route package requests through approved endpoints and neutralize +three background egress attempts that green builds would otherwise hide: + +- **Package registries:** `variables/shared.yml` routes npm/npx through the + anonymous PackageFeedProxy (`NPM_CONFIG_REGISTRY`) and Yarn through the + `ms/react-native-public` Azure Artifacts feed (`YARN_NPM_REGISTRY_SERVER`). + On CI, `templates/auth-npm-feed.yml` mints a managed-identity token for the + Azure Artifacts feed and writes it to `~/.npmrc` and `~/.yarnrc.yml` before + any install. - **Verdaccio (CLI init tests):** `verdaccio/generate-config.js` emits the config at runtime, so the uplink targets the feed (with the CI token when present) while local packages still publish offline. The former static `config.yaml` was removed. @@ -69,10 +70,11 @@ otherwise hide: CDN mid-build. This is an interim step; the durable fix is to bake it into the agent image. -Public PR builds read this feed **anonymously**, so they can only restore versions -an authenticated identity has already saved. A scheduled feed warm-up (maintained on -`main`, branch-agnostic) pre-populates the npm and NuGet dependency closures on the -feed and keeps those anonymous restores working. +Public PR Yarn and NuGet restores read the Azure Artifacts feed **anonymously**, +so they can only restore versions an authenticated identity has already saved. +A scheduled feed warm-up (maintained on `main`, branch-agnostic) pre-populates +the npm and NuGet dependency closures on the feed and keeps those anonymous +restores working. ## SDL and Component Governance From 66cbdf0d8cd6b223ce685713b6fff7388af34f66 Mon Sep 17 00:00:00 2001 From: Anukrati Agrawal Date: Mon, 12 Oct 2026 15:13:59 -0700 Subject: [PATCH 3/3] Align npm and Yarn validation registries Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0f63ea4f-a16b-4fa3-b141-785aec89b5e4 --- .ado/README.md | 22 +++++++++++----------- .ado/build-template.yml | 2 +- .ado/templates/auth-npm-feed.yml | 3 +-- .ado/templates/prepare-js-env.yml | 2 +- .ado/variables/shared.yml | 5 ++--- 5 files changed, 16 insertions(+), 18 deletions(-) diff --git a/.ado/README.md b/.ado/README.md index e5e80b5c8dd..7ae9887cdca 100644 --- a/.ado/README.md +++ b/.ado/README.md @@ -53,12 +53,12 @@ ISS agents run under 1ES **Network Isolation**, which blocks egress to public CD The pipelines route package requests through approved endpoints and neutralize three background egress attempts that green builds would otherwise hide: -- **Package registries:** `variables/shared.yml` routes npm/npx through the - anonymous PackageFeedProxy (`NPM_CONFIG_REGISTRY`) and Yarn through the - `ms/react-native-public` Azure Artifacts feed (`YARN_NPM_REGISTRY_SERVER`). - On CI, `templates/auth-npm-feed.yml` mints a managed-identity token for the - Azure Artifacts feed and writes it to `~/.npmrc` and `~/.yarnrc.yml` before - any install. +- **Package registries:** `variables/shared.yml` routes npm/npx and Yarn through + the anonymous PackageFeedProxy (`NPM_CONFIG_REGISTRY` / + `YARN_NPM_REGISTRY_SERVER`). On CI, `templates/auth-npm-feed.yml` mints a + managed-identity token for direct access to the `ms/react-native-public` + Azure Artifacts feed. The token is scoped to that feed in `~/.npmrc` and + passed separately to the Verdaccio uplink; Yarn does not send it to the proxy. - **Verdaccio (CLI init tests):** `verdaccio/generate-config.js` emits the config at runtime, so the uplink targets the feed (with the CI token when present) while local packages still publish offline. The former static `config.yaml` was removed. @@ -70,11 +70,11 @@ three background egress attempts that green builds would otherwise hide: CDN mid-build. This is an interim step; the durable fix is to bake it into the agent image. -Public PR Yarn and NuGet restores read the Azure Artifacts feed **anonymously**, -so they can only restore versions an authenticated identity has already saved. -A scheduled feed warm-up (maintained on `main`, branch-agnostic) pre-populates -the npm and NuGet dependency closures on the feed and keeps those anonymous -restores working. +Public PR Verdaccio and NuGet restores read the Azure Artifacts feed +**anonymously**, so they can only restore versions an authenticated identity has +already saved. A scheduled feed warm-up (maintained on `main`, branch-agnostic) +pre-populates the npm and NuGet dependency closures on the feed and keeps those +anonymous restores working. ## SDL and Component Governance diff --git a/.ado/build-template.yml b/.ado/build-template.yml index 9d88ab2477f..0a350e1577e 100644 --- a/.ado/build-template.yml +++ b/.ado/build-template.yml @@ -164,7 +164,7 @@ extends: version: '24.x' displayName: Use Node.js 24.x - # CI is network-isolated; authenticate to the package feed before any npm/Yarn use. + # CI is network-isolated; acquire the feed token used by the Verdaccio uplink. - ${{ if eq(parameters.buildEnvironment, 'Continuous') }}: - template: .ado/templates/auth-npm-feed.yml@self diff --git a/.ado/templates/auth-npm-feed.yml b/.ado/templates/auth-npm-feed.yml index fcb841c459c..8a79d1cab36 100644 --- a/.ado/templates/auth-npm-feed.yml +++ b/.ado/templates/auth-npm-feed.yml @@ -1,4 +1,4 @@ -# Authenticates npm and Yarn 4 to the ms/react-native-public feed with the build's managed identity. +# Acquires a managed-identity token for direct npm requests and the Verdaccio feed uplink. steps: - task: AzureCLI@2 displayName: Authenticate to the package feed @@ -13,4 +13,3 @@ steps: Write-Host "##vso[task.setvariable variable=RNW_NPM_FEED_TOKEN;issecret=true]$token" $reg = '//pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/' Set-Content -Path (Join-Path $env:USERPROFILE '.npmrc') -Encoding ascii -Value "${reg}:_authToken=$token" - Set-Content -Path (Join-Path $env:USERPROFILE '.yarnrc.yml') -Encoding ascii -Value @('npmAlwaysAuth: true', "npmAuthToken: $token") diff --git a/.ado/templates/prepare-js-env.yml b/.ado/templates/prepare-js-env.yml index 0fc69c11a15..2643a5061b0 100644 --- a/.ado/templates/prepare-js-env.yml +++ b/.ado/templates/prepare-js-env.yml @@ -23,7 +23,7 @@ steps: displayName: Ensure npm directory for npx commands condition: eq(variables['Agent.OS'], 'Windows_NT') - # CI is network-isolated; authenticate to the package feed before install. + # CI is network-isolated; acquire the feed token used by the Verdaccio uplink. - ${{ if eq(parameters.buildEnvironment, 'Continuous') }}: - template: auth-npm-feed.yml diff --git a/.ado/variables/shared.yml b/.ado/variables/shared.yml index aaa80313ec1..72187a00d12 100644 --- a/.ado/variables/shared.yml +++ b/.ado/variables/shared.yml @@ -6,10 +6,9 @@ variables: NPM_CONFIG_YES: false NPM_CONFIG_CACHE: $(Agent.TempDirectory)/.npmCache - # Route npm through the anonymous proxy so PR and CI npx calls do not require feed authentication. + # Route npm and Yarn through the anonymous proxy so validation does not require feed authentication. NPM_CONFIG_REGISTRY: https://packagefeedproxy.microsoft.io/npm/ - # Route Yarn through the ms/react-native-public feed (npmjs upstream) on isolated agents. - YARN_NPM_REGISTRY_SERVER: https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/ + YARN_NPM_REGISTRY_SERVER: https://packagefeedproxy.microsoft.io/npm/ # Stop React Native DevTools from fetching its standalone shell binary via DotSlash from a # Facebook CDN on dev-server start, which is blocked under network isolation. The 'dev'