Route dependency restores through Central Feed Service

[fabiocav]

Summary

• move the repository NuGet configuration to the root so nested restores discover it, clear inherited sources, and map the complete package graph to azfunc/public/upstream-public
• make every Azure Pipelines DotNetCoreCLI@2 restore explicitly use the repository config
• route the Azurite global install through a CI-only authenticated .npmrc, including explicit mappings for all ten scopes in its resolved transitive graph
• quote and correct the GitHub Actions Windows solution argument

Validation

• cold-restored the complete root solution with isolated global-packages, HTTP, plugin, and CLI caches; verbose request logs contain only pkgs.dev.azure.com for NuGet requests and no direct nuget.org traffic
• cold-restored the legacy packages.config project through CFS only, including Microsoft.VisualStudio.Azure.Fabric.MSBuild, using quoted Windows argument arrays and paths containing spaces
• cold-installed Azurite 3.36.0 globally with isolated npm cache/prefix and NPM_CONFIG_USERCONFIG; request logs contain only CFS/Azure Artifacts blob hosts and no direct npm registry requests
• built all pipeline product projects in Release, packed the release artifacts to a path containing spaces, and passed 139 .NET 8 core tests using the pipeline's Visual Studio MSBuild toolchain
• scanned 14 generated NuGet packages; none contain .npmrc, NuGet.config, credentials, lockfiles, or node_modules
• ran the vulnerability listing through CFS only; it reports the existing high-severity transitive System.Net.Http and System.Text.RegularExpressions advisories, then exits nonzero because dotnet list package does not support the repository's legacy packages.config Service Fabric project

Python/pip/uv and repository package.json/lockfile surfaces are absent, so no configuration was added for them.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR centralizes dependency restore configuration so NuGet and npm traffic is routed through the Azure Artifacts “upstream-public” feed, and updates CI definitions to consistently use those repo-scoped configs (plus a small GitHub Actions quoting fix).

Changes:

• Add repo-root NuGet.config that clears inherited sources and maps all packages to azfunc/public/upstream-public; remove the legacy .nuget/NuGet.Config.
• Update Azure Pipelines DotNetCoreCLI@2 restore steps to explicitly use the repo NuGet.config.
• Route the Azurite global npm install through an authenticated, CI-only .npmrc, and fix quoting for the CodeQL workflow’s Windows dotnet commands.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
NuGet.config	New root NuGet source + mapping configuration targeting the upstream-public feed.
eng/templates/build.yml	Restore step now explicitly uses the repo NuGet.config.
eng/templates/build-steps.yml	Restore steps now explicitly use the repo NuGet.config (including test restore).
eng/templates/test.yml	Adds npm authentication and forces Azurite install to use the CI .npmrc.
eng/templates/.npmrc	Adds a CI-scoped npm registry configuration pointing to upstream-public (scoped registries + default).
.nuget/NuGet.Config	Removes the legacy NuGet config now replaced by the repo-root NuGet.config.
.github/workflows/codeQL.yml	Quotes and corrects Windows dotnet restore/build solution argument usage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.