fix(vscode): restore signing packages through CFS

[Brian Lam (lambrianmsft)]

Commit Type

• feature - New functionality
• fix - Bug fix
• refactor - Code restructuring without behavior change
• perf - Performance improvement
• docs - Documentation update
• test - Test-related changes
• chore - Maintenance/tooling

Risk Level

• Low - Minor changes, limited scope
• Medium - Moderate changes, some user impact
• High - Major changes, significant user/system impact

What & Why

The release build can complete npm packaging but fail while signing because MSBuild implicitly restores Microsoft.Build.NoTargets from public nuget.org, which is blocked by SR21 network isolation. This ports the fix from hotfix PR #9532 to main: signing dependencies restore through the authenticated azcode CFS NuGet endpoint, and the subsequent build cannot perform another implicit restore.

Impact of Change

• Users: No product behavior changes; enables production of a signed VS Code extension package.
• Developers: Release setup regenerates a CFS-only NuGet.config after release-tag checkout and exposes it through nugetConfigFile.
• System: Signing now authenticates Azure Artifacts, explicitly restores the signing project from that config, and builds with --no-restore. Setup and signing remain in the same build job so the pipeline variable persists.

Test Plan

• Unit tests added/updated
• E2E tests added/updated
• Manual testing completed
• Tested in: Parsed both Azure Pipelines templates with the repository's yaml@2.8.3; parsed and asserted the checked-in and generated NuGet configs contain only the DevDiv azcode endpoint; verified task ordering, nugetConfigFile wiring, exact patch equivalence to 604b39df6, the exact three-file diff, git diff --check, and an independent read-only code review.

Contributors

Brian Lam (@lambrianmsft)

Screenshots/Videos

Not applicable — pipeline-only change with no visual impact.

[github-actions]

🤖 AI PR Validation Report

PR Review Results

Thank you for your submission! Here's detailed feedback on your PR title and body compliance:

✅ PR Title

• Current: fix(vscode): restore signing packages through CFS
• Issue: None — valid fix: prefix with a scope, and clearly descriptive of the change.
• Recommendation: No change needed.

---

✅ Commit Type

• Exactly one type selected: fix - Bug fix.
• This matches the change: restoring signing package dependencies through CFS to fix a broken release/signing build.

---

✅ Risk Level

• Low is selected in the body and the risk:low label is present — both agree.
• This matches the advised estimate. The change is plain CI/pipeline automation (.azure-pipelines/* templates plus a repo NuGet.config) that does not ship to users, does not alter product runtime behavior, and does not change the repo's security/permissions governance (no pull_request_target, no elevated write scopes). low is correct.

---

✅ What & Why

• Current: Clear explanation of the SR21 network-isolation failure during signing and the port of the hotfix fix(vscode): restore signing packages through CFS #9532 to main.
• Issue: None.
• Recommendation: No change needed.

---

✅ Impact of Change

• All three audiences are addressed (Users, Developers, System) with meaningful detail.
• Recommendation:
  • Users: Already covered — no product behavior change; enables signed VS Code extension packaging.
  • Developers: Already covered — CFS-only NuGet.config regeneration and nugetConfigFile exposure.
  • System: Already covered — authenticated Azure Artifacts restore + --no-restore build in the same job.

---

✅ Test Plan

• "Manual testing completed" is checked with an adequate explanation: the change is pipeline/config YAML with no application code paths, so unit/E2E tests don't apply. Validation included template parsing, NuGet config assertions, task-ordering and patch-equivalence checks. This satisfies CHECK TESTS.

---

✅ Contributors

• Brian Lam (@lambrianmsft) is credited. No action needed.

---

✅ Screenshots/Videos

• Not applicable — pipeline/config-only change with no visual UI impact. No screenshots required.

---

Summary Table

Section	Status	Recommendation
Title	✅	No change needed
Commit Type	✅	No change needed
Risk Level	✅	low correct; label and body agree
What & Why	✅	No change needed
Impact of Change	✅	No change needed
Test Plan	✅	Manual testing justified for pipeline-only change
Contributors	✅	No change needed
Screenshots/Videos	✅	Not applicable

---

All checks pass — this PR is compliant with the team template and cleared to merge.

---

Powered by: Copilot CLI (claude-opus-4.8) | Last updated: Wed, 12 Aug 2026 23:43:53 GMT

[Copilot]

Pull request overview

Routes VS Code extension signing dependencies through the authenticated CFS NuGet feed under network isolation.

Changes:

• Generates a CFS-only NuGet configuration.
• Authenticates and explicitly restores signing dependencies.
• Prevents the signing build from restoring again.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
NuGet.config	Defines the CFS azcode package source.
.azure-pipelines/templates/sign.yml	Adds authentication, explicit restore, and --no-restore.
.azure-pipelines/templates/setup.yml	Generates the runtime NuGet configuration and pipeline variable.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.