Enforce CFSClean for Network Isolation

NuGet.Config

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <clear />
+    <!-- Do not add any additional feeds if new packages are needed they need to come from our azure-sdk-for-net DevOps feed which has an upstream set to nuget.org -->
+    <add key="azure-sdk-for-net" value="https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-net/nuget/v3/index.json" />
+  </packageSources>
+  <disabledPackageSources>
+    <clear />
+  </disabledPackageSources>
+</configuration>

eng/common/pipelines/templates/1es-redirect.yml

@@ -27,6 +27,7 @@ extends:
   parameters:
     settings:
       skipBuildTagsForGitHubPullRequests: true
+      networkIsolationPolicy: Permissive, CFSClean
     sdl:
       codeql:
         compiled:

eng/common/pipelines/templates/steps/auth-dev-feed.yml

@@ -0,0 +1,49 @@
+parameters:
+  DevFeedName: 'public/azure-sdk-for-python'
+  EnableTwineAuth: true
+  EnablePipAuth: true
+  EnableUvAuth: true
+
+steps:
+  - pwsh: |
+      # For safety default to publishing to the private feed.
+      # Publish to https://dev.azure.com/azure-sdk/internal/_packaging?_a=feed&feed=azure-sdk-for-python-pr
+      $devopsFeedName = 'internal/azure-sdk-for-python-pr'
+      if ('$(Build.Repository.Name)' -eq 'Azure/azure-sdk-for-python') {
+        # Publish to https://dev.azure.com/azure-sdk/public/_packaging?_a=feed&feed=azure-sdk-for-python
+        $devopsFeedName = '${{ parameters.DevFeedName }}'
+      }
+      echo "##vso[task.setvariable variable=DevFeedName]$devopsFeedName"
+      echo "Using DevopsFeed = $devopsFeedName"
+    displayName: Setup DevOpsFeedName
+
+  - ${{ if eq(parameters.EnableTwineAuth, true) }}:
+    - task: TwineAuthenticate@0
+      displayName: 'Twine Authenticate to feed'
+      inputs:
+        artifactFeeds: $(DevFeedName)
+
+  - ${{ if eq(parameters.EnablePipAuth, true) }}:
+    - task: PipAuthenticate@1
+      displayName: 'Pip Authenticate to feed'
+      inputs:
+        artifactFeeds: $(DevFeedName)
+        onlyAddExtraIndex: false
+
+  - ${{ if eq(parameters.EnableUvAuth, true) }}:
+    - pwsh: |
+        if ($env:PIP_INDEX_URL) {
+          Write-Host "Found pip index URL: $($env:PIP_INDEX_URL)"
+          # UV_DEFAULT_INDEX is the canonical replacement for the deprecated UV_INDEX_URL (uv 0.4.23+).
+          # PIP_INDEX_URL is set by PipAuthenticate@1 and contains embedded credentials, which uv
+          # will use for Basic auth against the ADO feed (and its PyPI upstream) per astral-sh/uv#12651.
+          Write-Host "##vso[task.setvariable variable=UV_DEFAULT_INDEX]$($env:PIP_INDEX_URL)"
+          # Disable keyring so uv uses the URL-embedded credentials directly.
+          Write-Host "##vso[task.setvariable variable=UV_KEYRING_PROVIDER]disabled"
+        } else {
+          Write-Host "##[warning]PIP_INDEX_URL not set - uv will fall back to public PyPI."
+        }
+        # Force any managed Python downloads to go directly to GitHub releases
+        # rather than the default CDN (releases.astral.sh).
+        Write-Host "##vso[task.setvariable variable=UV_PYTHON_INSTALL_MIRROR]https://github.com/astral-sh/python-build-standalone/releases/download"
+      displayName: 'Configure UV Authentication'

eng/common/pipelines/templates/steps/maven-authenticate.yml

@@ -0,0 +1,17 @@
+parameters:
+  SourceDirectory: $(Build.SourcesDirectory)
+
+steps:
+  # Copy mirror settings to default Maven location so all requests go through CFS
+  - pwsh: |
+      $m2Dir = if ($env:USERPROFILE) { "$env:USERPROFILE\.m2" } else { "$HOME/.m2" }
+      New-Item -ItemType Directory -Force -Path $m2Dir | Out-Null
+      Copy-Item -Path "${{ parameters.SourceDirectory }}/eng/settings.xml" -Destination "$m2Dir/settings.xml"
+    displayName: 'Setup Maven mirror settings'
+
+  # Authenticate with Azure Artifacts feeds
+  # MavenAuthenticate adds <server> entries to ~/.m2/settings.xml matching mirror id 'azure-sdk-for-java'
+  - task: MavenAuthenticate@0
+    displayName: 'Maven Authenticate'
+    inputs:
+      artifactsFeeds: 'azure-sdk-for-java'

eng/emitters/pipelines/templates/steps/build-step.yml

@@ -61,6 +61,10 @@ steps:
 
   - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
 
+  - template: /eng/common/pipelines/templates/steps/auth-dev-feed.yml
+
+  - template: /eng/common/pipelines/templates/steps/maven-authenticate.yml
+
   - task: NodeTool@0
     displayName: Install Node.js
     retryCountOnTaskFailure: 3