From ed385c3156a571659821468bfa38d4315801993c Mon Sep 17 00:00:00 2001
From: brflood <brflood@microsoft.com>
Date: Mon, 24 Aug 2026 13:46:01 -0700
Subject: [PATCH 1/2] Route NuGet restores through CFS

Enable CFSClean enforcement and authenticate the OneCRM Azure Artifacts feed before pipeline restores.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .azurepipelines/azure-pipelines-1ES.yml | 4 ++++
 NuGet.config                            | 7 +++++++
 src/blazor/nuget.config                 | 4 ++--
 src/nuget.config                        | 4 ++--
 4 files changed, 15 insertions(+), 4 deletions(-)
 create mode 100644 NuGet.config

diff --git a/.azurepipelines/azure-pipelines-1ES.yml b/.azurepipelines/azure-pipelines-1ES.yml
index f5b9e1552..aa13cdef1 100644
--- a/.azurepipelines/azure-pipelines-1ES.yml
+++ b/.azurepipelines/azure-pipelines-1ES.yml
@@ -9,6 +9,8 @@ resources:
 extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
   parameters:
+    settings:
+      networkIsolationPolicy: Permissive,CFSClean
     sdl:
       tsa:
         enabled: true
@@ -62,6 +64,8 @@ extends:
           inputs:
             version: 8.0.x
             installationPath: '$(Agent.ToolsDirectory)/dotnet'
+        - task: NuGetAuthenticate@1
+          displayName: 'Authenticate NuGet feeds'
         - task: DotNetCoreCLI@2
           displayName: 'Build and test'
           inputs:
diff --git a/NuGet.config b/NuGet.config
new file mode 100644
index 000000000..7e7bb79fe
--- /dev/null
+++ b/NuGet.config
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+    <packageSources>
+        <clear />
+        <add key="OneCRM_PublicPackages" value="https://pkgs.dev.azure.com/dynamicscrm/OneCRM/_packaging/OneCRM_PublicPackages/nuget/v3/index.json" />
+    </packageSources>
+</configuration>
diff --git a/src/blazor/nuget.config b/src/blazor/nuget.config
index 6fe0378e6..57f22c71b 100644
--- a/src/blazor/nuget.config
+++ b/src/blazor/nuget.config
@@ -2,7 +2,7 @@
 <configuration>
     <packageSources>
         <clear />
-        <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
-        <add key="local" value="../../packages" />                
+        <add key="OneCRM_PublicPackages" value="https://pkgs.dev.azure.com/dynamicscrm/OneCRM/_packaging/OneCRM_PublicPackages/nuget/v3/index.json" />
+        <add key="local" value="../../packages" />
     </packageSources>
 </configuration>
\ No newline at end of file
diff --git a/src/nuget.config b/src/nuget.config
index 24a3eee9a..aa6e24f54 100644
--- a/src/nuget.config
+++ b/src/nuget.config
@@ -2,7 +2,7 @@
 <configuration>
     <packageSources>
         <clear />
-        <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
-        <add key="local" value="../packages" />                
+        <add key="OneCRM_PublicPackages" value="https://pkgs.dev.azure.com/dynamicscrm/OneCRM/_packaging/OneCRM_PublicPackages/nuget/v3/index.json" />
+        <add key="local" value="../packages" />
     </packageSources>
 </configuration>
\ No newline at end of file

From 9992302666ba0fce51a4e46d4e4113dd938815c0 Mon Sep 17 00:00:00 2001
From: brflood <brflood@microsoft.com>
Date: Mon, 24 Aug 2026 14:06:21 -0700
Subject: [PATCH 2/2] Keep public and CFS restores isolated

Use the repository NuGet configuration for public GitHub workflows and force the authenticated CFS configuration only in the Azure release task.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .azurepipelines/azure-pipelines-1ES.yml  | 2 ++
 NuGet.config => .config/NuGet.CFS.config | 1 +
 src/blazor/nuget.config                  | 4 ++--
 src/nuget.config                         | 4 ++--
 4 files changed, 7 insertions(+), 4 deletions(-)
 rename NuGet.config => .config/NuGet.CFS.config (85%)

diff --git a/.azurepipelines/azure-pipelines-1ES.yml b/.azurepipelines/azure-pipelines-1ES.yml
index aa13cdef1..681b26e40 100644
--- a/.azurepipelines/azure-pipelines-1ES.yml
+++ b/.azurepipelines/azure-pipelines-1ES.yml
@@ -72,6 +72,8 @@ extends:
             command: 'run'
             projects: '$(Build.SourcesDirectory)/targets/targets.csproj'
             arguments: '-- ci -c $(BuildConfiguration)'
+          env:
+            RestoreConfigFile: '$(Build.SourcesDirectory)\.config\NuGet.CFS.config'
         - task: PublishTestResults@2
           inputs:
             testResultsFormat: 'VSTest'
diff --git a/NuGet.config b/.config/NuGet.CFS.config
similarity index 85%
rename from NuGet.config
rename to .config/NuGet.CFS.config
index 7e7bb79fe..8ea1154bf 100644
--- a/NuGet.config
+++ b/.config/NuGet.CFS.config
@@ -3,5 +3,6 @@
     <packageSources>
         <clear />
         <add key="OneCRM_PublicPackages" value="https://pkgs.dev.azure.com/dynamicscrm/OneCRM/_packaging/OneCRM_PublicPackages/nuget/v3/index.json" />
+        <add key="local" value="../packages" />
     </packageSources>
 </configuration>
diff --git a/src/blazor/nuget.config b/src/blazor/nuget.config
index 57f22c71b..6fe0378e6 100644
--- a/src/blazor/nuget.config
+++ b/src/blazor/nuget.config
@@ -2,7 +2,7 @@
 <configuration>
     <packageSources>
         <clear />
-        <add key="OneCRM_PublicPackages" value="https://pkgs.dev.azure.com/dynamicscrm/OneCRM/_packaging/OneCRM_PublicPackages/nuget/v3/index.json" />
-        <add key="local" value="../../packages" />
+        <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
+        <add key="local" value="../../packages" />                
     </packageSources>
 </configuration>
\ No newline at end of file
diff --git a/src/nuget.config b/src/nuget.config
index aa6e24f54..24a3eee9a 100644
--- a/src/nuget.config
+++ b/src/nuget.config
@@ -2,7 +2,7 @@
 <configuration>
     <packageSources>
         <clear />
-        <add key="OneCRM_PublicPackages" value="https://pkgs.dev.azure.com/dynamicscrm/OneCRM/_packaging/OneCRM_PublicPackages/nuget/v3/index.json" />
-        <add key="local" value="../packages" />
+        <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
+        <add key="local" value="../packages" />                
     </packageSources>
 </configuration>
\ No newline at end of file