Skip to content

Use public registries in GitHub Actions and authenticated release feeds - #1144

Open
Bill Schnurr (bschnurr) wants to merge 7 commits into
mainfrom
users/bschnurr/internal-package-feeds
Open

Use public registries in GitHub Actions and authenticated release feeds#1144
Bill Schnurr (bschnurr) wants to merge 7 commits into
mainfrom
users/bschnurr/internal-package-feeds

Conversation

@bschnurr

@bschnurr Bill Schnurr (bschnurr) commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Do not auto-merge.

Summary

  • GitHub Actions use public npm and PyPI without feed authentication. Localization explicitly selects public npm instead of the shared action's proxy default.
  • Azure DevDiv release pipelines retain the authenticated Pylance_PublicPackages npm feed via AZURE_ARTIFACTS_FEED and rely on the shared template's npm and PyPI authentication. They do not use packagefeedproxy.
  • Local Microsoft setup retains the feed-selection and lockfile tools. Debugger bundles remain platform-specific and are built in each test job.

Verification

  • 41 setup/registry tests, lint, formatting, and executable YAML/feed checks passed locally. Debugger lint and formatting used an existing debugger toolchain in a sibling worktree.
  • No Azure release build was queued; GitHub checks run on the pushed commit.

@bschnurr
Use template-authenticated internal feeds for release builds
dd1243d 
Match flake8/environments: pass Pylance_PublicPackages as the custom npm registry, use npm ci instead of the proxy-forcing ci:msft helper, and let PipAuthenticate supply Python feed credentials without per-step proxy overrides.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bschnurr Bill Schnurr (bschnurr) added the debt Code quality issues label Nov 12, 2026
@bschnurr
Bill Schnurr (bschnurr) enabled auto-merge (squash) November 12, 2026 16:46
@rchiodo

Rich Chiodo (rchiodo) commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🔒 Automated review in progress — Rich Chiodo (@rchiodo) is auto-reviewing this PR.

@rchiodo

Rich Chiodo (rchiodo) commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Reviewed commit: 58cae0cadaafcd2058e0bf2c6a7906b85cb42dbd

Result: 🔴 could-not-verify

Verification details

Verification: Automated verification is best effort. The PR author remains responsible for testing.

Summary: [unavailable] Container verification could not start and local execution was not authorized for this PR HEAD: C:\Program Files\RedHat\Podman\podman.EXE --connection pyrx-automation failed: stderr: Error: unable to start container "50175ab3578b53bce44a11c0b70be43ba626d5f476d48e38360eec24843dc54e": crun: open `memory.max` for writing: No such file or directory: OCI runtime attempted to invoke a command that was not found

Test runs: none recorded.

rchiodo
Rich Chiodo (rchiodo) previously approved these changes Nov 12, 2026
View reviewed changes

@rchiodo Rich Chiodo (rchiodo) left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved via Review Center.

@rchiodo Rich Chiodo (rchiodo) added the review-auto:approved Automated review: no blocking findings (approval posted). label Nov 12, 2026
@bschnurr
Honor authenticated release registries in ci:msft
7306e63 
Preserve the release variable names and ci:msft command. Honor the effective npm registry for lockfile rewriting and installation while inheriting the template-authenticated npmrc. Resolve PIP_PROXY_INDEX_URL from PipAuthenticate output so per-step pip settings retain feed credentials.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bschnurr Bill Schnurr (bschnurr) changed the title Use authenticated internal feeds in release pipelines Use internal release feeds without changing ci:msft callers Nov 12, 2026
@bschnurr
Use internal Microsoft package feed defaults
9ad2e04 
Replace packagefeedproxy defaults with Pylance_PublicPackages for npm and DevDiv/debugpy for pip. Preserve public defaults and update existing setup/registry tests. No workflow or credential changes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bschnurr Bill Schnurr (bschnurr) changed the title Use internal release feeds without changing ci:msft callers Use internal package feeds with authenticated ci:msft Nov 12, 2026
rchiodo
Rich Chiodo (rchiodo) reviewed Nov 12, 2026
View reviewed changes
Comment thread build/setup-npm-registry.js Resolved
@rchiodo Rich Chiodo (rchiodo) added review-auto:changes-requested Automated review: posted blocking findings to address. and removed review-auto:approved Automated review: no blocking findings (approval posted). labels Nov 12, 2026
@bschnurr
Normalize registry overrides before rewriting and installing
0548be2 
Ensure slashless npm registry overrides end in a slash before building lockfile download URLs and invoking npm ci. Add regressions for public/internal registry rewrites and both uppercase/lowercase environment overrides while preserving npm authentication.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@rchiodo Rich Chiodo (rchiodo) added review-auto:approved Automated review: no blocking findings (approval posted). and removed review-auto:changes-requested Automated review: posted blocking findings to address. labels Nov 12, 2026
@bschnurr
Use internal package feeds in GitHub workflows
8f0a26d 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
rchiodo
Rich Chiodo (rchiodo) reviewed Nov 12, 2026
View reviewed changes
Comment thread .github/workflows/pr-check.yml Outdated

env:
PIP_INDEX_URL: https://packagefeedproxy.microsoft.io/pypi/simple/
PIP_INDEX_URL: https://pkgs.dev.azure.com/devdiv/DevDiv/_packaging/debugpy/pypi/simple/

@rchiodo Rich Chiodo (rchiodo) Nov 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Issue · Please address or respond

📍 .github/workflows/pr-check.yml:9
High: The Skeptic reproduced HTTP 401 responses and failed pip resolution against this index, but this workflow and push-check.yml:14 provide no feed authentication before installing Python dependencies on fresh GitHub-hosted runners. Configure supported authentication before the first installation, and retain an accessible feed path for fork PRs where credentials cannot be supplied.

[verified]

@rchiodo Rich Chiodo (rchiodo) added review-auto:changes-requested Automated review: posted blocking findings to address. and removed review-auto:approved Automated review: no blocking findings (approval posted). labels Nov 12, 2026
@bschnurr
Authenticate GitHub package feed installs using Azure OIDC
7387b62 
Port the isort feed authentication action and npm/pip configuration. Retain per-platform debugger bundles because debugpy wheels are host-specific.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
rchiodo
Rich Chiodo (rchiodo) reviewed Nov 13, 2026
View reviewed changes
Comment thread .github/workflows/pr-check.yml Outdated
sparse-checkout-cone-mode: false

- name: Authenticate package feeds
uses: ./ci-actions/.github/actions/authenticate-feeds

@rchiodo Rich Chiodo (rchiodo) Nov 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Issue · Please address or respond

📍 .github/workflows/pr-check.yml:85
[unverified] Prior High-priority feedback 4557182465 remains open: this pull_request workflow now authenticates unconditionally, but the requested nonprivileged feed path for fork PRs is still absent. Provide an accessible fork route across build, lint, and test jobs without granting untrusted PR code privileged feed credentials, and demonstrate trusted and fork dependency installation under the repository’s actual OIDC settings; current-HEAD authentication failure has not been reproduced.

[unverified]

@bschnurr
Use public registries in GitHub Actions
58cae0c 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bschnurr Bill Schnurr (bschnurr) changed the title Use internal package feeds with authenticated ci:msft Use public registries in GitHub Actions and authenticated release feeds Nov 14, 2026
@rchiodo Rich Chiodo (rchiodo) added review-auto:approved Automated review: no blocking findings (approval posted). and removed review-auto:changes-requested Automated review: posted blocking findings to address. labels Nov 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rchiodo Rich Chiodo (rchiodo) rchiodo approved these changes

Assignees

No one assigned

Labels

debt Code quality issues review-auto:approved Automated review: no blocking findings (approval posted).

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bschnurr @rchiodo