[marcpopMSFT]

Port of the 1ES network isolation / CFS clean change to release/8.0.1xx.

What

Scopes the 1ES settings in .vsts-ci.yml by Build.Reason:

• Official builds (Build.Reason != PullRequest): networkIsolationPolicy: Permissive,CFSClean,CFSClean2,CFSClean3.
• Internal PR / unofficial builds (Build.Reason == PullRequest): networkIsolationMode: None so network isolation does not run.

Why

Internal PR builds extend the 1ES Unofficial template but still inject Network Isolation (default Enforce) and restore from public feeds, producing spurious CFS clean NOT COMPLIANT reports. Network isolation is not applicable to internal PR validation, so it is disabled there while CFS clean policy remains on official builds.

Companion to the internal main and internal/release/6.0.4xx changes.

[Copilot]

Pull request overview

Ports the 1ES network isolation / CFS clean configuration change onto release/8.0.1xx by scoping pipeline settings based on Build.Reason, so PR validation doesn’t trip network isolation/CFS clean compliance noise while official builds still enforce the full CFS clean policy set.

Changes:

• For non-PR (official) builds, explicitly sets networkIsolationPolicy: Permissive,CFSClean,CFSClean2,CFSClean3.
• For PR builds, disables network isolation via networkIsolationMode: None to avoid spurious CFS clean violations during public-feed restores.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[marcpopMSFT]

I've confirmed in a test build that there is no netiso check when none is specified. We don't want that check enabled for PR builds as those all use the unofficial pipelines and run tests which may hit things like nuget.org.

[marcpopMSFT]

Currently flagged in S360 for the template engine tests and format tests in particular that I could see. Rather than putting a bunch of effort into porting our helix work for those to 8 or finding some other solution, I'm just disabling netiso for PRs (it's not run for public PRs already).

[marcpopMSFT]

/backport to release/9.0.1xx

[github-actions]

Started backporting to release/9.0.1xx (link to workflow run)

[github-actions]

@marcpopMSFT backporting to release/9.0.1xx failed, the patch most likely resulted in conflicts. Please backport manually!

git am output

$ git cherry-pick 3c43a4a71e7833b5d4887abf76dc0829402fe581

Auto-merging .vsts-ci.yml
CONFLICT (content): Merge conflict in .vsts-ci.yml
error: could not apply 3c43a4a71e... [release/8.0.1xx] Disable network isolation on internal PR builds; enforce CFSClean3 on official (#55220)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"


$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: Disable network isolation on internal PR builds; enforce CFSClean3 on official
Using index info to reconstruct a base tree...
M	.vsts-ci.yml
Falling back to patching base and 3-way merge...
Auto-merging .vsts-ci.yml
CONFLICT (content): Merge conflict in .vsts-ci.yml
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Disable network isolation on internal PR builds; enforce CFSClean3 on official
Error: The process '/usr/bin/git' failed with exit code 128

Link to workflow output