[Bill Schnurr (bschnurr)]

Summary

Use internal Microsoft package feeds while preserving the original Azure release caller structure:

• build/package-feeds.json: Microsoft npm defaults to https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/Pylance_PublicPackages/npm/registry/; Microsoft pip defaults to https://pkgs.dev.azure.com/devdiv/DevDiv/_packaging/debugpy/pypi/simple/. Public defaults are unchanged.
• Stable/pre-release keep NPM_CONFIG_REGISTRY, PIP_PROXY_INDEX_URL, npm run ci:msft, and customNPMRegistry: $(NPM_CONFIG_REGISTRY).
• PIP_PROXY_INDEX_URL references $(PIP_INDEX_URL) provided by the template's PipAuthenticate@1, so the existing per-step environment mappings retain credentials rather than substituting an unauthenticated URL.
• ci:msft honors npm_config_registry / NPM_CONFIG_REGISTRY for lockfile rewriting and installation. With no override, it now uses the internal JSON default. Its npm child inherits NPM_CONFIG_USERCONFIG and credentials unchanged; Azure's npmAuthenticate@0 still obtains the credentials.

No secrets were created, changed, or rotated. GitHub PR and push workflows now use the internal pip endpoint from build/package-feeds.json, while npm run ci:msft continues to use its internal npm default. CodeQL now sets both internal endpoints explicitly. Template/localization pins, platform matrices, Node/Python versions, packaging and publishing settings are unchanged. GitHub Actions feed authentication is not provisioned by this change; accessing internal feeds requires existing credentials.

Verification

• GitHub workflow correction: all 41 setup/registry/lockfile tests passed, including a workflow regression reproduced before the fix. Parsed-YAML comparisons confirm only existing feed variables changed. Changed-file Prettier, ESLint using the installed shared isort toolchain/configuration, and whitespace checks passed.
• All six focused setup/registry suites passed after the default change (27 tests per repository), including default internal URLs, lockfile rewriting, public-feed preservation, environment precedence and authenticated npm configuration inheritance.
• Changed-file Prettier, ESLint (installed shared isort toolchain/configuration for worktrees without dependencies), exact JSON comparisons and whitespace checks passed.
• Earlier real npm installs against an isolated authenticated loopback registry passed for every helper. Both bearer-token and Azure-style basic-auth npmrc configurations passed for both helper variants; invalid credentials failed; npmrc contents were unchanged.
• Existing shared YAML guards and all 16 sibling Azure release previews passed for the unchanged release YAMLs, with publishing disabled. The two disabled environments definitions were expanded via enabled isort without enabling them.

No new Azure build was queued. The earlier validation run was canceled at the user's request with publishExtension: false. Local authentication tests verify credential use, not real internal-feed authorization. Auto-merge remains disabled; these changes require review.

[Rich Chiodo (rchiodo)]

🔒 Automated review in progress — Rich Chiodo (@rchiodo) is auto-reviewing this PR.

[Rich Chiodo (rchiodo)]

Reviewed commit: 8f0a26d38a417a1bf5de388a98b8b74c627174c6

Result: 🔴 could-not-verify

Verification details

Verification: Automated verification is best effort. The PR author remains responsible for testing.

Summary: [unavailable] Container verification could not start and local execution was not authorized for this PR HEAD: Podman machine 'pyrx-automation' is not running.

Test runs: none recorded.

[Rich Chiodo (rchiodo)]

Approved via Review Center.

[Rich Chiodo (rchiodo)]

Issue · Please address or respond

📍 .github/workflows/pr-check.yml:9
High: The Skeptic reproduced HTTP 401 responses and failed pip resolution against this index, but this workflow and push-check.yml:14 provide no feed authentication before installing Python dependencies on fresh GitHub-hosted runners. Configure supported authentication before the first installation, and retain an accessible feed path for fork PRs where credentials cannot be supplied.

[verified]