Honor authenticated release registries in ci:msft

Preserve the release variable names and ci:msft command. Honor the effective npm registry for lockfile rewriting and installation while inheriting the template-authenticated npmrc. Resolve PIP_PROXY_INDEX_URL from PipAuthenticate output so per-step pip settings retain feed credentials.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: bschnurr

build/azure-devdiv-pipeline.pre-release.yml

@@ -33,8 +33,11 @@ variables:
     value: VSCode-python-debugger
   - name: VsixName
     value: python-debugger.vsix
-  - name: AZURE_ARTIFACTS_FEED
+  - name: NPM_CONFIG_REGISTRY
     value: 'https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/Pylance_PublicPackages/npm/registry/'
+  - name: PIP_PROXY_INDEX_URL
+    # PipAuthenticate supplies the internal index URL with credentials before buildSteps.
+    value: '$(PIP_INDEX_URL)'
 
 parameters:
   - name: publishExtension
@@ -72,20 +75,28 @@ parameters:
   - name: buildSteps
     type: stepList
     default:
-      - script: npm ci
+      - script: npm run ci:msft
         displayName: Install NPM dependencies
 
       - script: python -m pip install -U pip
         displayName: Upgrade pip
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python -m pip install wheel
         displayName: Install wheel
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python -m pip install nox
         displayName: Install nox
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python -m nox --session install_bundled_libs
         displayName: Install Python dependencies
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python ./build/update_ext_version.py --for-publishing
         displayName: Update build number
@@ -102,7 +113,7 @@ extends:
     buildPlatforms: ${{ parameters.buildPlatforms }}
     buildSteps: ${{ parameters.buildSteps }}
     standardizedVersioning: true
-    customNPMRegistry: $(AZURE_ARTIFACTS_FEED)
+    customNPMRegistry: $(NPM_CONFIG_REGISTRY)
     publishExtension: ${{ parameters.publishExtension }}
     teamName: $(TeamName)
     ghCreateTag: true

build/azure-devdiv-pipeline.stable.yml

@@ -28,8 +28,11 @@ variables:
     value: VSCode-python-debugger
   - name: VsixName
     value: python-debugger.vsix
-  - name: AZURE_ARTIFACTS_FEED
+  - name: NPM_CONFIG_REGISTRY
     value: 'https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/Pylance_PublicPackages/npm/registry/'
+  - name: PIP_PROXY_INDEX_URL
+    # PipAuthenticate supplies the internal index URL with credentials before buildSteps.
+    value: '$(PIP_INDEX_URL)'
 
 parameters:
   - name: publishExtension
@@ -67,20 +70,28 @@ parameters:
   - name: buildSteps
     type: stepList
     default:
-      - script: npm ci
+      - script: npm run ci:msft
         displayName: Install NPM dependencies
 
       - script: python -m pip install -U pip
         displayName: Upgrade pip
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python -m pip install wheel
         displayName: Install wheel
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python -m pip install nox
         displayName: Install nox
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python -m nox --session install_bundled_libs
         displayName: Install Python dependencies
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python ./build/update_ext_version.py --release --for-publishing
         displayName: Update build number
@@ -97,7 +108,7 @@ extends:
     buildPlatforms: ${{ parameters.buildPlatforms }}
     buildSteps: ${{ parameters.buildSteps }}
     standardizedVersioning: true
-    customNPMRegistry: $(AZURE_ARTIFACTS_FEED)
+    customNPMRegistry: $(NPM_CONFIG_REGISTRY)
     publishExtension: ${{ parameters.publishExtension }}
     teamName: $(TeamName)
     ghCreateTag: true

build/setup-npm-registry.js

@@ -6,7 +6,7 @@ const { readFileSync, writeFileSync } = require('node:fs');
 const path = require('node:path');
 const { microsoft } = require('./package-feeds.json');
 
-function rewritePackageLock(source) {
+function rewritePackageLock(source, registry = microsoft.npm) {
     const lockfile = JSON.parse(source);
     if (
         ![2, 3].includes(lockfile.lockfileVersion) ||
@@ -19,16 +19,16 @@ function rewritePackageLock(source) {
 
     return source.replace(/("resolved"\s*:\s*)("(?:\\.|[^"\\])*")/g, (match, prefix, encodedUrl) => {
         const url = JSON.parse(encodedUrl);
-        const rewritten = url.replace(/^https:\/\/registry\.(?:npmjs\.org|yarnpkg\.com)\//, microsoft.npm);
+        const rewritten = url.replace(/^https:\/\/registry\.(?:npmjs\.org|yarnpkg\.com)\//, registry);
         return rewritten === url ? match : prefix + JSON.stringify(rewritten);
     });
 }
 
-function rewritePackageLocks(root = path.resolve(__dirname, '..')) {
+function rewritePackageLocks(root = path.resolve(__dirname, '..'), registry = microsoft.npm) {
     const files = [path.join(root, 'package-lock.json')];
     const updates = files.map((file) => {
         const source = readFileSync(file, 'utf8');
-        return { file, source, rewritten: rewritePackageLock(source) };
+        return { file, source, rewritten: rewritePackageLock(source, registry) };
     });
     for (const { file, source, rewritten } of updates) {
         if (rewritten !== source) {
@@ -48,13 +48,13 @@ if (require.main === module) {
         if (install && !process.env.npm_execpath) {
             throw new Error('Run npm install using npm run ci:msft.');
         }
-        rewritePackageLocks();
+        const registry = process.env.npm_config_registry || process.env.NPM_CONFIG_REGISTRY || microsoft.npm;
+        rewritePackageLocks(undefined, registry);
         if (install) {
-            const result = spawnSync(
-                process.execPath,
-                [process.env.npm_execpath, 'ci', `--registry=${microsoft.npm}`],
-                { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' },
-            );
+            const result = spawnSync(process.execPath, [process.env.npm_execpath, 'ci', `--registry=${registry}`], {
+                cwd: path.resolve(__dirname, '..'),
+                stdio: 'inherit',
+            });
             if (result.error || result.signal || result.status !== 0) {
                 const reason = result.error?.message || result.signal || `exit code ${result.status}`;
                 const error = new Error(`npm ci failed: ${reason}`);

build/setup-npm-registry.test.js

@@ -100,20 +100,20 @@ test('missing or invalid root lockfile fails explicitly', (t) => {
     assert.throws(() => rewritePackageLocks(root), /Expected an npm lockfile/);
 });
 
-function runCli({ args = ['--ci'], npmCli = 'npm-cli.js', result = { status: 0 } } = {}) {
+function runCli({ args = ['--ci'], npmCli = 'npm-cli.js', result = { status: 0 }, env = {} } = {}) {
     const calls = [];
     const errors = [];
     const process = {
         argv: ['node', 'setup-npm-registry.js', ...args],
-        env: { npm_execpath: npmCli },
+        env: { npm_execpath: npmCli, ...env },
         execPath: 'node',
     };
     const module = { exports: {} };
     const mockedRequire = (name) => {
         if (name === 'node:fs') {
             return {
                 readFileSync: () => source,
-                writeFileSync: (file) => calls.push({ file }),
+                writeFileSync: (file, source) => calls.push({ file, source }),
             };
         }
         if (name === 'node:child_process') {
@@ -150,6 +150,31 @@ test('ci:msft rewrites the root lockfile before installing with the shared proxy
     assert.equal(scripts['ci:msft'], 'node ./build/setup-npm-registry.js --ci');
 });
 
+test('ci:msft preserves template authentication for the configured internal registry', () => {
+    const registry = 'https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/Pylance_PublicPackages/npm/registry/';
+    for (const settings of [
+        { NPM_CONFIG_REGISTRY: registry },
+        { npm_config_registry: registry },
+        { NPM_CONFIG_REGISTRY: proxyRegistry, npm_config_registry: registry },
+    ]) {
+        const env = {
+            ...settings,
+            NPM_CONFIG_USERCONFIG: path.join(tmpdir(), 'authenticated.npmrc'),
+            NODE_AUTH_TOKEN: 'test-token',
+        };
+        const context = runCli({ env });
+        const install = context.calls.at(-1);
+        assert.deepEqual(install.args, ['npm-cli.js', 'ci', `--registry=${registry}`]);
+        assert.equal(install.env, undefined);
+        assert.equal(context.process.env.NPM_CONFIG_USERCONFIG, env.NPM_CONFIG_USERCONFIG);
+        assert.equal(context.process.env.NODE_AUTH_TOKEN, env.NODE_AUTH_TOKEN);
+        for (const write of context.calls.slice(0, -1)) {
+            assert.equal(write.source, rewritePackageLock(source, registry));
+        }
+        assert.equal(context.errors.length, 0);
+    }
+});
+
 for (const result of [{ status: 7 }, { status: null, signal: 'SIGTERM' }, { error: new Error('not found') }]) {
     test(`ci:msft reports npm failure: ${result.signal || result.error?.message || result.status}`, () => {
         const context = runCli({ result });