chore(vscode): backport CFS build and release updates to v5.991

[Brian Lam (lambrianmsft)]

Commit Type

• feature - New functionality
• fix - Bug fix
• refactor - Code restructuring without behavior change
• perf - Performance improvement
• docs - Documentation update
• test - Test-related changes
• chore - Maintenance/tooling

Risk Level

• Low - Minor changes, limited scope
• Medium - Moderate changes, some user impact
• High - Major changes, significant user/system impact

What & Why

Backports the four already-reviewed CFS build and release pipeline changes from #9520, #9521, #9522, and #9523 onto hotfix/v5.991, preserving their order and patch content. Together they route package restore through the authenticated CFS-backed Azure Artifacts feed, propagate the npm user configuration through the VS Code extension build and Turbo tasks, and update release packaging to use the supported 1ES tooling path.

The source commits were cherry-picked in this order:

1. chore(vscode): Onboard release pipelines to CFS #9520 b3633b7bb38c64f2bbac14389340adc80146ff80 → 4ea7112ac8ba39c1a4d87696b61ec48c0ff2d3c5
2. chore(vscode): Fix CFS pipeline npm auth #9521 4b3b6067c195316ade0f2533369c33e6f8239717 → e23d5dc3f4e7b067116f3ec2e126cdf2f0a78617
3. fix(vscode): Fix VS Code extension CFS npm install #9522 e9d56c1f51e145580f0309db7c656c718ec1dadb → bbf7acd4e1f3fcad18cbc5fa8f2d5ac88b55c07e
4. fix(vscode): Pass CFS npmrc through Turbo #9523 7659a9ddff2a1a648e8dbedf285029a03ed27c5e → bca419970f69d20e71bce7d2d90de1ff3e00d11b

Impact of Change

• Users: No product UI or runtime behavior changes; this only affects producing the v5.991 hotfix build.
• Developers: VS Code extension build and packaging steps now receive the authenticated npm user configuration, including nested installs under dist.
• System: Release and build pipelines use CFS-backed package restore and updated 1ES/Node tooling. A pipeline misconfiguration could block hotfix packaging, so the change is classified as medium risk.

Test Plan

• Unit tests added/updated
• E2E tests added/updated
• Manual testing completed
• Tested in: Verified stable patch-id equality for every source/backport pair; ran git diff --check; ran node --check on install-dist-dependencies.js; parsed the changed package and Turbo JSON; parsed all six changed Azure Pipelines YAML files with js-yaml. No product code or test files changed, so focused static validation is the smallest relevant local check; the hotfix PR CI provides integration validation.

Contributors

Brian Lam (@lambrianmsft) and Copilot

Screenshots/Videos

Not applicable; there are no visual changes.

[github-actions]

🤖 AI PR Validation Report

PR Review Results

Thank you for your submission! Here's detailed feedback on your PR title and body compliance:

✅ PR Title

• Current: chore(vscode): backport CFS build and release updates to v5.991
• Issue: None — uses the valid chore: prefix with a (vscode) scope and is descriptive.
• Recommendation: No change needed.

---

✅ Commit Type

• Exactly one box selected: chore - Maintenance/tooling.
• Appropriate for build/release pipeline and tooling changes with no product runtime behavior change.

---

✅ Risk Level

• Medium is selected in the body and the risk:medium label is applied — both match. This aligns with my advised estimate: the change touches VS Code extension distribution (apps/vs-code-designer) build/packaging and release automation, including authenticated CFS-backed package restore, which is Medium impact (not shipped-product/security-breaking, so not High).

---

✅ What & Why

• Current: Clear explanation that this backports four already-reviewed CFS build/release changes (chore(vscode): Onboard release pipelines to CFS #9520–fix(vscode): Pass CFS npmrc through Turbo #9523) onto hotfix/v5.991, with cherry-pick order and commit hashes.
• Issue: None.
• Recommendation: No change needed.

---

✅ Impact of Change

• All three audiences addressed (Users: no UI/runtime change; Developers: build/packaging now receives authenticated npm userconfig; System: pipelines use CFS-backed restore and updated 1ES/Node tooling).
• Recommendation:
  • Users: Documented — no product-facing change.
  • Developers: Documented — build/packaging config change.
  • System: Documented — release/build pipeline change.

---

✅ Test Plan

• Manual testing is checked with a clear, adequate explanation: changes are build/release YAML, package.json, turbo.json, and a new install helper script — no product code or test files. Static validation (patch-id equality, git diff --check, node --check, JSON/YAML parsing) plus hotfix CI is appropriate, so automated unit/E2E tests are reasonably not required.

---

⚠️ Contributors

• Populated with @lambrianmsft and @Copilot. Non-blocking.

---

✅ Screenshots/Videos

• Not applicable — no changes to visual UI files (libs/designer-ui/src, libs/designer/src, apps/vs-code-react/src UI). Correctly marked N/A.

---

Summary Table

Section	Status	Recommendation
Title	✅	No change needed
Commit Type	✅	No change needed
Risk Level	✅	Medium matches advised estimate
What & Why	✅	No change needed
Impact of Change	✅	No change needed
Test Plan	✅	Explanation adequate for tooling change
Contributors	⚠️	Optional — already credited
Screenshots/Videos	✅	N/A — no visual changes

---

All required checks pass. This PR is compliant with the team template and is cleared to merge.

---

Powered by: Copilot CLI (claude-opus-4.8) | Last updated: Wed, 12 Aug 2026 20:53:02 GMT