Route generation module installs through the private CFS feed (PS Gallery follow-up) [draft] - #3720
Draft
Gavin Barron (gavinbarron) wants to merge 1 commit into
Draft
Conversation
…hell Gallery follow-up) Phase 2 of the PowerShell CFSClean remediation: eliminate the CFSClean2-tier egress to www.powershellgallery.com / cdn.powershellgallery.com in the generation pipelines (187/221/663) by routing every generation-time Install-Module/Find-Module through the private Azure Artifacts feed PowerShell_V2_Build, which already has a PowerShell Gallery upstream (so it serves both the internally published Graph modules and public tooling modules). Mechanism: - Expose $(System.AccessToken) as a process-wide SYSTEM_ACCESSTOKEN variable in weekly-generation.yml, command-metadata-refresh.yml and ci-build.yml, so credentials are available to every step and to the ForEach-Object -Parallel runspaces used by GenerateModules.ps1. - install-tools.yml: new "Register private module feed" step registers PowerShell_V2_Build as a Trusted PSRepository (persisted for the job). - tools/Get-CfsFeedCredential.ps1: shared helper (Get-CfsFeedName / Get-CfsFeedCredential / Register-CfsFeed) that builds a PSCredential from SYSTEM_ACCESSTOKEN; returns $null locally so behaviour is unchanged off-CI. - Repoint sources from PSGallery to PowerShell_V2_Build and inject the credential via $PSDefaultParameterValues (runspace-local, so it works inside the parallel generation): ValidateUpdatedModuleVersion, GenerateRollUpModule, GenerateMetaModule, GenerateAuthenticationModule, BuildModule, Versions/BumpModuleVersion, plus the ad-hoc tooling installs (PlatyPS, Pester, powershell-yaml, PowerHTML) in GenerateHelp/TestModule/ImportExamples/ UpdateOpenApi. DRAFT: requires CI validation. Open questions to confirm in a pipeline run: - ValidateUpdatedModuleVersion's version gate now queries the private feed (with PSGallery upstream) instead of public PSGallery directly; confirm the published-version comparison still behaves as intended (the upstream proxies public versions, but the feed may also expose internally published versions). - Confirm www.powershellgallery.com / cdn.powershellgallery.com drop to 0 in the generation jobs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Generation runs
Install-Module/Find-Moduleagainst the public PowerShell Gallery (www.powershellgallery.com+cdn.powershellgallery.com), which trips CFSClean2. Telemetry (e.g. 221 build 230408, 663 build 232382) shows these hits in every workload generation job.Approach
The private Azure Artifacts feed
PowerShell_V2_Buildalready has a PowerShell Gallery upstream (confirmed via the feed's upstream sources), so it can serve both the internally published Graph modules and the public tooling modules (Pester, PlatyPS, powershell-yaml, PowerHTML). Route all generation module operations through it.Changes
SYSTEM_ACCESSTOKEN: $(System.AccessToken)tovariables:inweekly-generation.yml,command-metadata-refresh.yml,ci-build.yml— so credentials are available to every step and to theForEach-Object -Parallelrunspaces inGenerateModules.ps1.install-tools.yml: new Register private module feed step registersPowerShell_V2_Buildas a TrustedPSRepository(persisted for the job).tools/Get-CfsFeedCredential.ps1(new): shared helper —Get-CfsFeedName,Get-CfsFeedCredential(builds aPSCredentialfromSYSTEM_ACCESSTOKEN; returns$nulllocally so off-CI behaviour is unchanged),Register-CfsFeed.PSGallery→PowerShell_V2_Build, injecting the credential via$PSDefaultParameterValues(runspace-local, so it works inside parallel generation):ValidateUpdatedModuleVersion,GenerateRollUpModule,GenerateMetaModule,GenerateAuthenticationModule,BuildModule,Versions/BumpModuleVersion, and the ad-hoc tooling installs inGenerateHelp/TestModule/ImportExamples/UpdateOpenApi.Validation (in CI)
www.powershellgallery.com/cdn.powershellgallery.com= 0 in the generation jobs (187/221/663).ValidateUpdatedModuleVersionnow queries the private feed (PSGallery upstream) rather than public PSGallery directly — confirm the published-version comparison still gates correctly (the upstream proxies public versions, but the feed may also surface internally published versions).Related
s360-cfs/pipeline-cfs-compliance-status.md.