fix(vscode): restore signing packages through CFS

[Brian Lam (lambrianmsft)]

Commit Type

• feature - New functionality
• fix - Bug fix
• refactor - Code restructuring without behavior change
• perf - Performance improvement
• docs - Documentation update
• test - Test-related changes
• chore - Maintenance/tooling

Risk Level

• Low - Minor changes, limited scope
• Medium - Moderate changes, some user impact
• High - Major changes, significant user/system impact

What & Why

The v5.991 release build now completes npm packaging but fails while signing because MSBuild implicitly restores Microsoft.Build.NoTargets from public nuget.org. This change routes signing dependencies through the authenticated azcode CFS NuGet endpoint and prevents the subsequent build from performing another implicit restore.

Impact of Change

• Users: No product behavior changes; enables production of a signed VS Code extension package.
• Developers: Signing restores now use an explicit CFS-only NuGet.config generated after release-tag checkout.
• System: Adds Azure Artifacts authentication, an explicit restore, and --no-restore for the signing build so CI has no direct NuGet Gallery dependency.

Test Plan

• Unit tests added/updated
• E2E tests added/updated
• Manual testing completed
• Tested in: PowerShell runtime-config generation and XML validation, CFS source-policy validation, git diff --check, Biome, and independent pipeline diff review. The release pipeline will validate authenticated package restore and signing end to end.

Contributors

Brian Lam (@lambrianmsft)

Screenshots/Videos

N/A — pipeline-only change.

[github-actions]

🤖 AI PR Validation Report

PR Review Results

Thank you for your submission! Here's detailed feedback on your PR title and body compliance:

✅ PR Title

• Current: fix(vscode): restore signing packages through CFS
• Issue: None — valid fix: prefix with scope and a clear, descriptive summary.
• Recommendation: No change needed.

---

✅ Commit Type

• Exactly one type selected: fix - Bug fix.
• Appropriate for a pipeline restore/signing fix.

---

✅ Risk Level

• Low selected in the body and the risk:low label is present — both match. This is a CI/pipeline-only change (.azure-pipelines/* templates and a new root NuGet.config) that does not ship to users and does not alter repo security/governance posture (no pull_request_target, no elevated permissions). My advised estimate is low, which matches the declared level.

---

✅ What & Why

• Current: Explains that the v5.991 release fails signing due to implicit restore from public nuget.org, and routes signing deps through the authenticated azcode CFS endpoint while preventing a second implicit restore.
• Issue: None — clear context and rationale.
• Recommendation: No change needed.

---

✅ Impact of Change

• All three audiences addressed (Users, Developers, System).
• Recommendation:
  • Users: No product behavior change; enables a signed VS Code extension package.
  • Developers: Signing restores now use an explicit CFS-only NuGet.config.
  • System: Adds Azure Artifacts auth, explicit restore, and --no-restore build.

---

✅ Test Plan

• No shipped-code changes — this is a pipeline/config-only change, so automated unit/E2E tests are not applicable. Manual testing is checked with a clear explanation (PowerShell config generation, XML validation, CFS source-policy check, git diff --check, Biome, pipeline diff review). Passes per CHECK TESTS.

---

✅ Contributors

• Credited Brian Lam (@lambrianmsft). Good.

---

✅ Screenshots/Videos

• N/A — no UI files touched (libs/designer-ui/src, libs/designer/src, or apps/vs-code-react UI). Not required.

---

Summary Table

Section	Status	Recommendation
Title	✅	No change needed
Commit Type	✅	No change needed
Risk Level	✅	low matches advised estimate
What & Why	✅	No change needed
Impact of Change	✅	No change needed
Test Plan	✅	Manual testing justified for pipeline-only change
Contributors	✅	No change needed
Screenshots/Videos	✅	Not applicable

---

All checks pass — this PR is compliant and ready to merge. Nice, thorough writeup.

---

Powered by: Copilot CLI (claude-opus-4.8) | Last updated: Wed, 12 Aug 2026 23:29:17 GMT

[github-actions]

🤖 AI PR Validation Report

PR Review Results

Thank you for your submission! Here's detailed feedback on your PR title and body compliance:

✅ PR Title

• Current: fix(vscode): restore signing packages through CFS
• Issue: None — valid fix: prefix with scope and a clear, descriptive summary.
• Recommendation: No change needed.

---

✅ Commit Type

• Exactly one type selected: fix - Bug fix.
• Matches the title prefix and the nature of the change (restoring the signing/packaging pipeline).

---

❌ Risk Level

• Declared Medium (body + risk:medium label), but the advised estimate is Low. This is a CI/release-pipeline-only change: it edits .azure-pipelines/templates/setup.yml and sign.yml and adds a root NuGet.config to route signing restores through the authenticated CFS feed. It does not ship to users, does not alter product runtime behavior, and does not change repo governance/permissions (no pull_request_target, no elevated write scopes, no auth/credential-handling in shipped code). Per the rubric, plain CI/build automation that neither ships to users nor changes security posture is Low. Action: change the body selection to Low and swap the label to risk:low.

---

✅ What & Why

• Current: Explains that the v5.991 signing build fails because MSBuild implicitly restores Microsoft.Build.NoTargets from public nuget.org (blocked by SR21 isolation), and that this routes signing deps through the authenticated azcode CFS feed and prevents a second implicit restore.
• Issue: None — clear problem statement and rationale.
• Recommendation: No change needed.

---

✅ Impact of Change

• All three audiences addressed (Users: no product behavior change; Developers: explicit CFS-only NuGet.config; System: added Azure Artifacts auth + explicit restore + --no-restore).
• Recommendation:
  • Users: No change needed.
  • Developers: No change needed.
  • System: No change needed.

---

✅ Test Plan

• No shipped code changes — only pipeline YAML and a NuGet.config. Automated unit/E2E tests do not apply, and "Manual testing" is checked with a clear explanation (PowerShell config generation/XML validation, CFS source-policy validation, git diff --check, Biome, pipeline diff review). Satisfies CHECK TESTS.

---

✅ Contributors

• @lambrianmsft credited. No change needed.

---

✅ Screenshots/Videos

• Not applicable — no UI files touched (libs/designer-ui, libs/designer, apps/vs-code-react). Marked N/A appropriately.

---

Summary Table

Section	Status	Recommendation
Title	✅	No change needed
Commit Type	✅	No change needed
Risk Level	❌	Change to Low in body and set label risk:low
What & Why	✅	No change needed
Impact of Change	✅	No change needed
Test Plan	✅	No change needed
Contributors	✅	No change needed
Screenshots/Videos	✅	N/A

---

Almost there! The only blocker is an over-declared risk level — this pipeline-only change should be Low, not Medium. Update the Risk Level checkbox to Low and change the label to risk:low, and this PR will pass.

---

Powered by: Copilot CLI (claude-opus-4.8) | Last updated: Wed, 12 Aug 2026 23:14:28 GMT