Enforce CFSClean for Network Isolation

eng/1es-redirect.yml

@@ -36,6 +36,7 @@ extends:
         - 1ES.PT.Tag-refs/tags/canary
     settings:
       skipBuildTagsForGitHubPullRequests: true
+      networkIsolationPolicy: Permissive, CFSClean
     sdl:
       git:
         longpaths: true

eng/test-steps.yml

@@ -8,17 +8,33 @@ steps:
   - task: UseDotNet@2
     inputs:
       version: 6.x
+
   - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+    parameters:
+      npmrcPath: $(Agent.TempDirectory)/oad.npmrc
+
   - script: npm ci
     displayName: npm ci
+    env:
+      NPM_CONFIG_USERCONFIG: $(Agent.TempDirectory)/oad.npmrc
+
   - script: npm run lint
     displayName: lint
+
   - script: npm run prettier
     displayName: prettier
+
   - script: npm test
     displayName: test
+    env:
+      NPM_CONFIG_USERCONFIG: $(Agent.TempDirectory)/oad.npmrc
+      autorest_registry: https://packagefeedproxy.microsoft.io/npm/
+
   - script: npm pack
     displayName: pack
+    env:
+      NPM_CONFIG_USERCONFIG: $(Agent.TempDirectory)/oad.npmrc
+
   - task: CopyFiles@2
     displayName: "Copy Files to Staging"
     inputs:

src/lib/validators/openApiDiff.ts

@@ -19,6 +19,31 @@ const _ = require("lodash")
 
 const execFile = util.promisify(child_process.execFile)
 
+const getAutoRestNpmrcPath = (): string | undefined => {
+  const candidates = [process.env.npm_config_userconfig, process.env.NPM_CONFIG_USERCONFIG]
+  return candidates.find(value => typeof value === "string" && value.trim().length > 0)
+}
+
+export const getAutoRestRegistry = (npmrcPath = getAutoRestNpmrcPath()): string | undefined => {
+  const configuredRegistry = [process.env.autorest_registry, process.env.npm_config_registry, process.env.NPM_CONFIG_REGISTRY].find(
+    value => typeof value === "string" && value.trim().length > 0
+  )
+  if (configuredRegistry) {
+    return configuredRegistry.trim()
+  }
+
+  if (!npmrcPath || !fs.existsSync(npmrcPath)) {
+    return undefined
+  }
+
+  const registryEntry = fs
+    .readFileSync(npmrcPath, "utf8")
+    .split(/\r?\n/u)
+    .map(line => line.match(/^\s*registry\s*=\s*["']?([^"'#;]+)["']?\s*(?:[#;].*)?$/iu)?.[1]?.trim())
+    .find(value => value)
+  return registryEntry
+}
+
 export type Options = {
   readonly consoleLogLevel?: unknown
   readonly logFilepath?: unknown
@@ -241,13 +266,28 @@ export class OpenApiDiff {
     ]
 
     const args = [...autoRestArgs, ...swaggerArgs, ...commonArgs]
+    const autoRestNpmrcPath = getAutoRestNpmrcPath()
+    const autoRestRegistry = getAutoRestRegistry(autoRestNpmrcPath)
+    const env = {
+      ...process.env,
+      NODE_OPTIONS: "--max-old-space-size=8192",
+      ...(autoRestNpmrcPath ? { npm_config_userconfig: autoRestNpmrcPath, NPM_CONFIG_USERCONFIG: autoRestNpmrcPath } : {}),
+      ...(autoRestRegistry ? { autorest_registry: autoRestRegistry } : {})
+    }
+
+    if (autoRestNpmrcPath) {
+      log.debug(`Using npm user config for AutoRest: ${autoRestNpmrcPath}`)
+    }
+    if (autoRestRegistry) {
+      log.debug(`Using npm registry for AutoRest core: ${autoRestRegistry}`)
+    }
 
     log.debug(`Executing: "${autoRestFile} ${args.join(" ")}"`)
 
     const { stderr } = await execFile(autoRestFile, args, {
       encoding: "utf8",
       maxBuffer: 1024 * 1024 * 64,
-      env: { ...process.env, NODE_OPTIONS: "--max-old-space-size=8192" }
+      env
     })
     if (stderr) {
       // autorest 3.8.0 emits deprecation message to stderr with exit code 0

src/test/openApiDiffTest.ts

@@ -0,0 +1,31 @@
+import * as assert from "assert"
+import * as fs from "fs"
+import * as os from "os"
+import * as path from "path"
+import { getAutoRestRegistry } from "../lib/validators/openApiDiff"
+
+describe("OpenApiDiff", () => {
+  it("gets the AutoRest core registry from the npm user config", () => {
+    const tempFolder = fs.mkdtempSync(path.join(os.tmpdir(), "oad-npmrc-"))
+    const npmrcPath = path.join(tempFolder, ".npmrc")
+    fs.writeFileSync(npmrcPath, "@azure:registry=https://example.invalid/scoped/\nregistry=https://packagefeedproxy.microsoft.io/npm/\n")
+
+    const environmentVariables = ["autorest_registry", "npm_config_registry", "NPM_CONFIG_REGISTRY"] as const
+    const originalValues = environmentVariables.map(name => process.env[name])
+    environmentVariables.forEach(name => delete process.env[name])
+
+    try {
+      assert.equal(getAutoRestRegistry(npmrcPath), "https://packagefeedproxy.microsoft.io/npm/")
+    } finally {
+      environmentVariables.forEach((name, index) => {
+        const originalValue = originalValues[index]
+        if (originalValue === undefined) {
+          delete process.env[name]
+        } else {
+          process.env[name] = originalValue
+        }
+      })
+      fs.rmSync(tempFolder, { recursive: true, force: true })
+    }
+  })
+})