[release/8.0.1xx] Disable network isolation on internal PR builds; enforce CFSClean3 on official#55220
Conversation
… official Internal PR builds (unofficial-ci) extend the 1ES Unofficial template but still inject Network Isolation (default Enforce). They restore from public feeds, producing spurious CFS clean violations. Scope the 1ES settings by Build.Reason: keep CFSClean3 policy on official builds, and set networkIsolationMode: None on the PR/unofficial path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Ports the 1ES network isolation / CFS clean configuration change onto release/8.0.1xx by scoping pipeline settings based on Build.Reason, so PR validation doesn’t trip network isolation/CFS clean compliance noise while official builds still enforce the full CFS clean policy set.
Changes:
- For non-PR (official) builds, explicitly sets
networkIsolationPolicy: Permissive,CFSClean,CFSClean2,CFSClean3. - For PR builds, disables network isolation via
networkIsolationMode: Noneto avoid spurious CFS clean violations during public-feed restores.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
I've confirmed in a test build that there is no netiso check when none is specified. We don't want that check enabled for PR builds as those all use the unofficial pipelines and run tests which may hit things like nuget.org. |
|
Currently flagged in S360 for the template engine tests and format tests in particular that I could see. Rather than putting a bunch of effort into porting our helix work for those to 8 or finding some other solution, I'm just disabling netiso for PRs (it's not run for public PRs already). |
Port of the 1ES network isolation / CFS clean change to
release/8.0.1xx.What
Scopes the 1ES
settingsin.vsts-ci.ymlbyBuild.Reason:Build.Reason != PullRequest):networkIsolationPolicy: Permissive,CFSClean,CFSClean2,CFSClean3.Build.Reason == PullRequest):networkIsolationMode: Noneso network isolation does not run.Why
Internal PR builds extend the 1ES Unofficial template but still inject Network Isolation (default
Enforce) and restore from public feeds, producing spurious CFS cleanNOT COMPLIANTreports. Network isolation is not applicable to internal PR validation, so it is disabled there while CFS clean policy remains on official builds.Companion to the internal
mainandinternal/release/6.0.4xxchanges.