Enforce CFSClean network isolation in 1ES pipelines

.azure-pipelines.yml

@@ -28,6 +28,8 @@ extends:
 
               - script: 'node common/scripts/install-run-rush.js test'
                 displayName: 'rush test'
+                env:
+                  autorest_registry: 'https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-js/npm/registry/'
 
               - script: 'node common/scripts/install-run-rush.js regen-ruleindex'
                 displayName: 'rush regen-ruleindex'

azure-pipelines/1es-redirect.yml

@@ -25,6 +25,7 @@ extends:
   parameters:
     settings:
       skipBuildTagsForGitHubPullRequests: true
+      networkIsolationPolicy: Permissive, CFSClean
     sdl:
       git:
         longpaths: true

azure-pipelines/common-build.yml

@@ -9,6 +9,10 @@ steps:
       versionSpec: '${{ parameters.NodeVersion }}'
     displayName: 'Install Node.js ${{ parameters.NodeVersion }}'
 
+  - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+    parameters:
+      npmrcPath: $(Build.SourcesDirectory)/common/config/rush/.npmrc
+
   - script: 'node common/scripts/install-run-rush.js install'
     displayName: 'rush install'
 

eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml

@@ -0,0 +1,41 @@
+parameters:
+  - name: npmrcPath
+    type: string
+    # When empty, defaults to the agent user's .npmrc ($HOME/.npmrc on
+    # Linux/macOS, %USERPROFILE%\.npmrc on Windows) so every subsequent
+    # npm / pnpm / npx call in the job inherits the registry + auth.
+    default: ""
+  - name: registryUrl
+    type: string
+    default: "https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-js/npm/registry/"
+  - name: CustomCondition
+    type: string
+    default: succeeded()
+  - name: ServiceConnection
+    type: string
+    default: ""
+
+steps:
+  - pwsh: |
+      $npmrcPath = '${{ parameters.npmrcPath }}'
+      if (-not $npmrcPath) { $npmrcPath = Join-Path $HOME '.npmrc' }
+
+      Write-Host "Creating .npmrc file $npmrcPath for registry ${{ parameters.registryUrl }}"
+      $parentFolder = Split-Path -Path $npmrcPath -Parent
+
+      if ($parentFolder -and -not (Test-Path $parentFolder)) {
+        Write-Host "Creating folder $parentFolder"
+        New-Item -Path $parentFolder -ItemType Directory | Out-Null
+      }
+
+      "registry=${{ parameters.registryUrl }}" | Out-File $npmrcPath
+      Write-Host "##vso[task.setvariable variable=resolvedNpmrcPath]$npmrcPath"
+    displayName: "Create .npmrc"
+    condition: ${{ parameters.CustomCondition }}
+
+  - task: npmAuthenticate@0
+    displayName: Authenticate .npmrc
+    condition: ${{ parameters.CustomCondition }}
+    inputs:
+      workingFile: $(resolvedNpmrcPath)
+      azureDevOpsServiceConnection: ${{ parameters.ServiceConnection }}