[wenyt (wenytang-ms)]

Summary

Add npm_config_registry to extends.parameters.sdl.sourceAnalysisVariablesToReset in .azure-pipelines/ci.yml, .azure-pipelines/nightly.yml, and .azure-pipelines/rc.yml. Preserve CI's existing SDL source-analysis pool and leave Build's CFS configuration, Node versions, and feed permissions unchanged.

This prevents the pipeline-wide CFS registry environment variable from overriding Guardian's feed-scoped authenticated temporary .npmrc in injected SDL source-analysis jobs. It follows the validated fix in microsoft/vscode-spring-boot-dashboard#453.

Observed nightly failure

Debugger nightly 20261030.1 / build 32409803, running main at a114556, failed before source scanning with:

PackageInstallerException: Failed to install Npm package: eslint v7.32.0

The Build stage and VSIX artifact succeeded. The failure is in Guardian's injected SDL job, not the extension's lint or package steps.

The upstream 1ES update changed Node initialization, leaving Guardian using the image's system npm instead of the previously installed ToolCache npm. The pipeline-wide CFS registry override conflicts with Guardian's feed-scoped file-authentication fallback. A same-image, same-toolchain Spring Dashboard registry-only control run 32408902 passed both Guardian ESLint tasks after clearing only this SDL registry variable; no Node downgrade or feed-permission change was needed.

Scope audit

Audited all five pipelines on current main (a114556) using Azure Pipelines template previews:

Pipeline	Definition	Injected SDL source analysis	Action
CI	16490	Yes	Reset registry in SDL only
Nightly	16488	Yes	Reset registry in SDL only
RC	16489	Yes	Reset registry in SDL only
release-nightly	21189	No	Unchanged
release	21190	No	Unchanged

The release pipelines use 1ES templates but compile to release/tag jobs without injected SDL source analysis, so no reset is needed there.

Validation

• YAML parsing and git diff --check passed.
• Azure Pipelines previewRun: true with yamlOverride compiled all five baseline and final configurations successfully in mseng/VSJava.
• Verified the three affected pipelines retain the global CFS registry and compile an empty npm_config_registry override only in SDLSources_self.
• Compared compiled configurations: every non-SDL job in the affected pipelines is unchanged; both release configurations are unchanged. Source-level comparison confirms the only semantic additions are the requested SDL resets.
• No build/release runs were manually queued, and nothing was merged.
• Revalidated the exact PR commit e90a15a with previews of all five final configurations and automated assertions for global versus SDL registry scope.
• A local, network-free npm configuration check reproduces the precedence conflict: the inherited CFS registry overrides a Guardian-style temporary user config; clearing it restores the temporary config's Guardian feed.
• The existing Azure Pipelines PR run 32409147 passed, including SDL source analysis and CFS dependency validation.

Current check blocker

The existing GitHub Actions Windows check failed in Windows process discovery / converts a legacy code page to UTF-8 in FullLanguage mode with spawnSync powershell.exe ETIMEDOUT. That test and its implementation are unchanged by this YAML-only PR; no unrelated test fix is included.

Other Java extensions

The same Guardian installation failure was found in Maven nightly 32408936, Maven RC 32408927, and Java Test pre-release 32408766.

Current source already contains corresponding merged fixes: microsoft/vscode-maven#1235, microsoft/vscode-java-test#1952, microsoft/vscode-java-dependency#1117, microsoft/vscode-java-pack#1789, microsoft/vscode-gradle#1979 (active develop branch), microsoft/vscode-spring-initializr#328, and microsoft/vscode-spring-boot-dashboard#453. No additional cross-repository changes or duplicate PRs were made.

Limitations

This is a preventive isolation fix based on the validated cross-repository issue. No repository-specific HTTP 401 reproduction or post-fix execution run is claimed; preview compilation does not execute Guardian.