[Eduardo Villalpando Mello (edvilme)]

Summary

• Select the supported Preferred,GitHub,NodeTool network isolation policy so checkout, GitHub API provenance checks, and Node installation have the access they require.
• Keep network isolation enforced and preserve existing publication approvals and artifact validation.
• Reuse the existing authenticated Azure Artifacts npm setup in the publish job, avoiding dependency installation directly from the public npm registry.

Validation

• YAML structure and manual build-only default verified.
• Prettier and git diff --check passed.
• Lint and TypeScript compilation passed.
• Unit tests: 3,511 passing, 9 pending (Node 22.21.1).
• Azure server-side YAML override preview was denied because the account lacks the pipeline's EditBuild permission; live pipeline validation is still required.
• A fresh build-only run (quality=stable, publishPackage=false) was also denied because the account lacks Queue builds permission. No validation run was started.

Release follow-up

This changes only pipeline YAML, so the existing api/package.json path filter will not trigger publication automatically. After validation and merge, queue a new official run at the fixed main commit with quality=stable and publishPackage=true. Do not retry the old failed run with its original YAML. The checkout failure did not publish npm 1.8.0, so no additional package version bump is needed.

[Copilot]

🔵 Needs a closer look

External Azure template dependencies and denied preview/build permissions leave compatibility, feed authentication, and network access unverified, requiring an authorized pipeline owner to validate before publication.

No open issues 🎉

What changed in this PR

Updates the npm release pipeline to support required network access while retaining network isolation, publication approvals, and artifact validation.

Changes:

• Sets the network isolation policy to Preferred,GitHub,NodeTool.
• Reuses the shared setup template in the publish job to configure Node and the authenticated Azure Artifacts npm registry.

Live pipeline validation remains pending because preview and queue permissions were unavailable.

File	Description
build/​azure-pipeline.npm.yml	Configures the network isolation policy and authenticated npm setup for publication.

_{Review effort: Balanced}

[Eduardo Villalpando Mello (edvilme)]

Added no-merge, will do a dry-run before merging.

[Stella Huang (StellaHuang95)]

🔒 Automated review in progress — Stella Huang (@StellaHuang95) is auto-reviewing this PR.

[Stella Huang (StellaHuang95)]

Reviewed commit: 7b55ea8898889e9437120781b882ecf932f2eedc

Result: 🔴 could-not-verify

Verification details

Verification: Automated verification is best effort. The PR author remains responsible for testing.

Summary: [unavailable] Container verification could not start and local execution was not authorized for this PR HEAD: Podman CLI is not installed or is not on PATH.

Test runs: none recorded.

[Stella Huang (StellaHuang95)]

Approved via Review Center.

[Rich Chiodo (rchiodo)]

Approved via Review Center.