Dongbo Wang (daxian-dbw) · Nov 5, 2026 · Nov 5, 2026
@@ -216,6 +216,7 @@ extends:
             Write-Verbose -Verbose "Completed building PowerShell for '$env:BuildConfiguration' configuration"
           displayName: 'Build Windows Universal - $(Architecture)-$(BuildConfiguration) Symbols folder'
           env:
+            VSS_NUGET_EXTERNAL_FEED_ENDPOINTS: $(VSS_NUGET_EXTERNAL_FEED_ENDPOINTS)
             ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
 
         # Add CodeQL Finalize task right after your 'Build' step.

@@ -204,6 +204,7 @@ stages:
         displayName: Build Windows Universal - $(Architecture) -$(BuildConfiguration) Symbols folder
         env:
           __DOTNET_RUNTIME_FEED_KEY: $(RUNTIME_SOURCEFEED_KEY)
+          VSS_NUGET_EXTERNAL_FEED_ENDPOINTS: $(VSS_NUGET_EXTERNAL_FEED_ENDPOINTS)
           ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
 
       - task: CodeQL3000Finalize@0 # Add CodeQL Finalize task right after your 'Build' step.

diff --git a/docs/building/internals.md b/docs/building/internals.md
@@ -49,6 +49,8 @@ The flags can also be enabled together. The shared
 [`insert-nuget-config-azfeed.yml`](../../.pipelines/templates/insert-nuget-config-azfeed.yml)
 template installs the Azure Artifacts Credential Provider and supplies an Azure DevOps
 access token through the secret `VSS_NUGET_EXTERNAL_FEED_ENDPOINTS` variable.
+Build steps must explicitly map this secret variable into their `env` block,
+including module-only builds; Azure Pipelines does not automatically export secret variables.
 The `powershell-net-early-access` service connection identity must have read access
 to the module feed. The existing PowerShell feed continues to use its separate PAT.
 For local restores, install the Azure Artifacts Credential Provider and use

diff --git a/test/infrastructure/NugetConfig.Tests.ps1 b/test/infrastructure/NugetConfig.Tests.ps1
@@ -88,6 +88,21 @@ Describe 'Early-access module feeds' {
         }
     }
 
+    It 'Maps secret feed credentials directly into the build environment in <Pipeline>' -TestCases @(
+        @{ Pipeline = '.pipelines/templates/stages/PowerShell-vPack-Stages.yml' }
+        @{ Pipeline = '.pipelines/MSIXBundle-vPack-Official.yml' }
+    ) {
+        param($Pipeline)
+
+        $template = Get-Content "$PSScriptRoot/../../$Pipeline" -Raw
+        $buildStep = [regex]::Match($template, '(?ms)^\s*displayName: [''"]?Build Windows Universal[^\r\n]*\r?\n(?<envIndent> +)env:\r?\n(?<env>.*?)(?=^\k<envIndent>\S|\z)')
+        $buildStep.Success | Should -BeTrue
+        $envIndent = $buildStep.Groups['envIndent'].Value + '  '
+        $buildStep.Groups['env'].Value | Should -Match (
+            '(?m)^' + $envIndent + 'VSS_NUGET_EXTERNAL_FEED_ENDPOINTS: \$\(VSS_NUGET_EXTERNAL_FEED_ENDPOINTS\)\r?$'
+        )
+    }
+
     BeforeEach {
         $env:EARLY_ACCESS_FEED = 'net10'
         Mock New-NugetConfigFile -ModuleName build {}