chore(vscode): Onboard release pipelines to CFS

[Brian Lam (lambrianmsft)]

Commit Type

• feature - New functionality
• fix - Bug fix
• refactor - Code restructuring without behavior change
• perf - Performance improvement
• docs - Documentation update
• test - Test-related changes
• chore - Maintenance/tooling

Risk Level

• Low - Minor changes, limited scope
• Medium - Moderate changes, some user impact
• High - Major changes, significant user/system impact

What & Why

Updates Azure Pipelines release/build configuration for AzRel MountainPass SR21 / 1ES Network Isolation CFS adoption. The build now configures the CFS-backed DevDiv Azure Artifacts npm registry before package restore, authenticates that feed, installs the pinned pnpm version through that authenticated CFS registry, and applies the CFSClean network-isolation policy. The release pipeline keeps its existing Azure Tools release template and explicitly passes the same CFS-backed npm feed for the template's vsce install step. Also updates the build setup from deprecated NodeTool@0 to UseNode@1 to remove the ADO task deprecation warning.

Impact of Change

• Users: No product UI/runtime impact.
• Developers: Release/build pipeline dependency restore now requires the configured CFS-backed Azure Artifacts feed and authentication.
• System: Pipeline network behavior is constrained to support CFSClean policy compliance and avoid public npm restore paths.

Test Plan

• Unit tests added/updated
• E2E tests added/updated
• Manual testing completed
• Tested in: Local pipeline YAML/static checks: git diff --check, no-tab/final-newline hygiene checks, and targeted scan for public npm registry, package feed proxy, npx, deprecated NodeTool@0, hosted vmImage, raw artifact publish, and unintended release-template migration references under .azure-pipelines.

Contributors

N/A

Screenshots/Videos

N/A

[github-actions]

🤖 AI PR Validation Report

PR Review Results

Thank you for your submission! Here's detailed feedback on your PR title and body compliance:

✅ PR Title

• Current: chore(vscode): Onboard release pipelines to CFS
• Issue: None — valid chore prefix with scope and a descriptive summary.
• Recommendation: No change needed.

---

✅ Commit Type

• Exactly one type selected: chore - Maintenance/tooling.
• This correctly matches the pipeline/tooling nature of the change.

---

❌ Risk Level

• You declared Medium (body checkbox and risk:medium label agree with each other), but the advised estimate is Low. This change only touches Azure DevOps release/build pipeline YAML under .azure-pipelines/. It does not ship to users, does not alter shipped product/runtime behavior, and does not change the repository's GitHub governance/permissions posture (no pull_request_target, no issues:/pull-requests: write, no branch-push/PR-open automation). Per the rubric, plain CI/pipeline automation that doesn't ship to users and doesn't change repo governance is Low. Please change the body selection to Low and update the label to risk:low.

---

✅ What & Why

• Current: Clear explanation of CFS onboarding: configuring the CFS-backed DevDiv npm registry, authenticating the feed, installing pinned pnpm through it, applying CFSClean network isolation, and moving NodeTool@0 → UseNode@1.
• Issue: None.
• Recommendation: No change needed.

---

✅ Impact of Change

• All three audiences are addressed (Users/Developers/System).
• Recommendation:
  • Users: As stated — no product UI/runtime impact.
  • Developers: As stated — restore now requires the configured CFS-backed feed and authentication.
  • System: As stated — pipeline network behavior constrained for CFSClean compliance.

---

✅ Test Plan

• No shippable code changes — only pipeline YAML/config. Automated tests are not applicable, and Manual testing is checked with a clear explanation (static/YAML hygiene checks and targeted scans). This satisfies CHECK TESTS.

---

⚠️ Contributors

• Listed as N/A. If any PMs, designers, or reviewers contributed, credit them. Non-blocking.

---

✅ Screenshots/Videos

• Not required — no visual/UI files under libs/designer-ui/src/, libs/designer/src/, or apps/vs-code-react/src/ are touched. Pipeline-only change.

---

Summary Table

Section	Status	Recommendation
Title	✅	No change needed
Commit Type	✅	No change needed
Risk Level	❌	Change to Low and update label to risk:low
What & Why	✅	No change needed
Impact of Change	✅	No change needed
Test Plan	✅	No change needed
Contributors	⚠️	Credit contributors if any
Screenshots/Videos	✅	Not applicable

---

This PR is blocked by one issue: the declared risk level (Medium) does not match the advised estimate (Low). Update the Risk Level checkbox to Low and change the label to risk:low, then this PR will pass.

---

Powered by: Copilot CLI (claude-opus-4.8) | Last updated: Tue, 11 Aug 2026 01:04:09 GMT

[Copilot]

Pull request overview

Onboards build and release pipelines to CFS-backed dependency restoration and 1ES network isolation.

Changes:

• Configures authenticated CFS npm/pnpm restores and CFSClean.
• Migrates release publishing to the 1ES template.
• Refreshes six generated Graphify reports.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
.azure-pipelines/1esmain.yml	Enables CFS variables and network isolation.
.azure-pipelines/release.yml	Migrates the release template.
.azure-pipelines/templates/setup.yml	Installs pinned pnpm and authenticates CFS.
.azure-pipelines/templates/package.yml	Uses locally installed packaging tools.
.azure-pipelines/templates/sign.yml	Uses local vsce for manifest generation.
libs/vscode-extension/src/graphify-out/GRAPH_REPORT.md	Regenerates dependency graph report.
libs/logic-apps-shared/src/graphify-out/GRAPH_REPORT.md	Regenerates dependency graph report.
libs/designer-ui/src/graphify-out/GRAPH_REPORT.md	Regenerates dependency graph report.
libs/data-mapper-v2/src/graphify-out/GRAPH_REPORT.md	Regenerates dependency graph report.
libs/chatbot/src/graphify-out/GRAPH_REPORT.md	Regenerates dependency graph report.
libs/a2a-core/src/graphify-out/GRAPH_REPORT.md	Regenerates dependency graph report.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.