[wenyt (wenytang-ms)]

Summary

Add npm_config_registry to extends.parameters.sdl.sourceAnalysisVariablesToReset in CI, Nightly and RC. This isolates SDL/Guardian from the Build-only global CFS registry.

Preserve global Build CFS routing, all existing sourceAnalysisPool/pool settings, SpotBugs and network-isolation settings where present, Node versions and permissions. Release YAMLs are unchanged.

Validation

• Parsed the actual source YAML and checked its diff against main at 6360cc0cdc1d03562689a6cfeb7d41ec85b9beed.
• Baseline/final previewRun:true + yamlOverride compilations succeeded for every enabled source definition: 16478, 16479, 16480, with self fixed to that SHA.
• Whole-document comparison confirms the only compiled change is npm_config_registry: '' in SDLSources_self; all other compiled content is identical.
• All enabled release definitions (21458, 21459) compiled without SDL source analysis, so their YAMLs remain unchanged.
• git diff --check passed.

Scope and limitations

This is the same narrow isolation used in microsoft/vscode-spring-boot-dashboard#453.

Preview compiles but does not execute Guardian/feed authentication. No repository-specific npm6/E401 reproduction or post-fix runtime success is claimed. No build or release was manually queued.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Changyong Gong (chagong)]

Reviewed the complete diff and pipeline context. The SDL-only npm_config_registry reset is consistent across CI, Nightly and RC and preserves global Build CFS routing, pools, network-isolation policy, Node versions, permissions and release YAMLs. No blocking code issues found; all reported GitHub checks pass. No Azure run is currently reported on this PR, so I have not independently verified its SDL/CFS runtime or the reported preview compilations.