From e1afdff64a161957b78010d8f1b403b25f411e73 Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Mon, 20 Jul 2026 09:12:03 -0700
Subject: [PATCH] Route NuGet restore through the CFS central package feed

Routes CI package restore through the authenticated GraphDeveloperExperiences_Public Azure Artifacts feed (network isolation / CFS compliance). Requires a pipeline run to validate against the feed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 9bd6fe40-0d69-4e3f-927b-8628c0ab6d34
---
 .azure-pipelines/ci-build.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/.azure-pipelines/ci-build.yml b/.azure-pipelines/ci-build.yml
index cb2182cab3e..672647cc473 100644
--- a/.azure-pipelines/ci-build.yml
+++ b/.azure-pipelines/ci-build.yml
@@ -62,11 +62,27 @@ extends:
             packageType: sdk
             version: 10.x
               
+        - task: NuGetAuthenticate@1
+          displayName: 'Authenticate to Azure Artifacts'
+
+        - pwsh: |
+            @"
+            <?xml version="1.0" encoding="utf-8"?>
+            <configuration>
+              <packageSources>
+                <clear />
+                <add key="GraphDeveloperExperiences_Public" value="https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public/nuget/v3/index.json" />
+              </packageSources>
+            </configuration>
+            "@ | Set-Content -Path "$(Build.SourcesDirectory)/nuget.config" -Encoding UTF8
+          displayName: 'Create nuget.config (central feed)'
         - task: DotNetCoreCLI@2
           displayName: 'dotnet restore'
           inputs:
             command: restore
             projects: '**/*.csproj'
+            feedsToUse: "config"
+            nugetConfigPath: "$(Build.SourcesDirectory)/nuget.config"
         - powershell: |
             # This allows us to not have to checkin .csproj files with DelaySign and SignAssembly set to to true. If the flag is set,
             # then project is not debuggable with SignAssembly set to true.