Repository navigation
[release/v7.7.0] Fix module-only vPack build feed credentials - #28369
Merged
Justin Chung (jshigetomi) merged 1 commit intoNov 6, 2026
Merged
Justin Chung (jshigetomi) merged 1 commit into
Justin Chung (jshigetomi) merged 1 commit into
Conversation
Justin Chung (jshigetomi)
added
the
CL-BuildPackaging
Justin Chung (jshigetomi)
changed the title
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Azure Pipelines validation is needed to confirm authenticated restores, service-connection access, and secret propagation through OneBranch for vPack and MSIX builds, which static checks cannot verify.
No open issues 🎉
What changed in this PR
Backports #28356 to release/v7.7.0, fixing authenticated bundled-module restores in vPack and MSIX builds when UseEarlyAccessModules is enabled without IsEarlyAccess.
Changes:
- Explicitly maps secret feed credentials into both build-step environments while preserving runtime-feed-key behavior.
- Adds regression tests requiring direct credential mappings in both pipelines.
- Documents Azure Pipelines’ explicit secret-mapping requirement.
| File | Description |
|---|---|
test/infrastructure/NugetConfig.Tests.ps1 |
Adds regression coverage for both build-step credential mappings. |
docs/building/internals.md |
Documents explicit secret mapping, including module-only builds. |
.pipelines/templates/stages/PowerShell-vPack-Stages.yml |
Removes the early-access condition from the vPack credential mapping. |
.pipelines/MSIXBundle-vPack-Official.yml |
Maps MSIX feed credentials independently of the runtime-feed-key condition. |
Review effort: Balanced
Aditya Patwardhan (adityapatwardhan)
approved these changes
Nov 6, 2026
Dongbo Wang (daxian-dbw)
deleted the
backport/release/v7.7.0/28356-1aac7f5e3
branch
November 6, 2026 17:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #28356 to release/v7.7.0
Triggered by Justin Chung (@jshigetomi) on behalf of Aditya Patwardhan (@adityapatwardhan)
Original CL Label: CL-BuildPackaging
/cc @PowerShell/powershell-maintainers
Impact
Tooling Impact
Fixes authenticated bundled-module restores in vPack and MSIX builds when
UseEarlyAccessModulesis enabled withoutIsEarlyAccess. Both build steps explicitly map the secretVSS_NUGET_EXTERNAL_FEED_ENDPOINTSvariable into their environment, since Azure Pipelines does not automatically export secret variables.Customer Impact
Regression
Fixes credential mapping omitted when the internal module-feed feature from #28326 was backported to release/v7.7.0 via merged prerequisite #28366.
Testing
Includes the original PR's regression coverage requiring direct secret credential mappings in both build-step environment blocks. The clean cherry-pick applied without conflicts. The original PR validated both pipeline YAML files across all four early-access flag combinations, preserved existing runtime-feed-key behavior and secret publication, passed PowerShell syntax parsing and
git diff --check, and verified the new regression-test regexes against fixed and original files. Local Pester could not run because Pester and PowerShell Gallery access were unavailable. Backport CI, including Azure Pipelines authentication validation, must pass before merge.Risk
Changes shared build pipeline authentication, but the fix is limited to explicit environment mappings for the existing secret variable. Runtime-feed-key behavior is unchanged, and regression tests cover both mappings. CI validation is required before merge.