Add networkIsolationPolicy to 1ES pipeline templates for SFI-ES4.2.4 compliance

[joperezr]

Summary

Adds networkIsolationPolicy: Permissive,CFSClean2 to the 1ES pipeline template parameters to resolve the [SFI-ES4.2.4] "Network Isolation for CFS endpoints" S360 KPI violation (CFSClean violation type).

Background

The S360 KPI [SFI-ES4.2.4] requires that CI/CD pipelines use Central Feed Service (CFS) package feeds, Azure Artifacts feeds, rather than public package registries, to enforce supply chain security and network isolation.

Our NuGet.config already exclusively uses Azure Artifacts/CFS-compliant feeds (all pointing to pkgs.dev.azure.com/dnceng or dnceng.pkgs.visualstudio.com). No public feeds like nuget.org are referenced. However, the 1ES pipeline template parameters were missing the networkIsolationPolicy declaration, which is what the compliance scanner checks for.

What the setting means

• Permissive - Allows broader outbound network access during pipeline runs. This is appropriate for public/OSS repos that need to access multiple Azure Artifacts feeds, npm registries (for the VS Code extension build), and other legitimate external endpoints.
• CFSClean2 - Declares CFS compliance at the current wave level, confirming that package dependency resolution goes through Azure Artifacts/CFS rather than direct public registries.

Precedent

This is the same approach used by dotnet/source-indexer (see their azure-pipelines.yml), which previously had the same CFSClean violation and resolved it with this one-line setting.

Changes

• eng/pipelines/azure-pipelines.yml - Added settings.networkIsolationPolicy: Permissive,CFSClean2 under extends.parameters
• eng/pipelines/azure-pipelines-unofficial.yml - Same change applied

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 14696

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 14696"

[Copilot]

Pull request overview

Adds the 1ES pipeline template parameter settings.networkIsolationPolicy: Permissive,CFSClean2 to address SFI-ES4.2.4 (CFS endpoint network isolation) compliance scanning requirements for the repo’s CI pipelines.

Changes:

• Add settings.networkIsolationPolicy: Permissive,CFSClean2 to eng/pipelines/azure-pipelines.yml (official pipeline).
• Add the same settings.networkIsolationPolicy to eng/pipelines/azure-pipelines-unofficial.yml (unofficial pipeline).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
eng/pipelines/azure-pipelines.yml	Passes settings.networkIsolationPolicy into the 1ES Official template parameters.
eng/pipelines/azure-pipelines-unofficial.yml	Passes settings.networkIsolationPolicy into the 1ES Unofficial template parameters.

[mitchdenny]

Looks good — purely a compliance declaration change with no functional impact on build behavior. The Permissive mode keeps outbound access open, and CFSClean2 satisfies the S360 scanner.