build: migrate to CFS

eng/ci/emulator-tests.yml

@@ -49,6 +49,4 @@ extends:
       jobs:
       - template: /eng/templates/jobs/ci-emulator-tests.yml@self
         parameters:
-          PoolName: 1es-pool-azfunc
-          ArtifactFeed: 'internal/PythonWorker_Internal_PublicPackages'
-          NuGetServiceConnection: 'PythonWorker_Internal_PublicPackages'
+          PoolName: 1es-pool-azfunc

eng/ci/official-build.yml

@@ -63,16 +63,12 @@ extends:
           - template: /eng/templates/jobs/ci-emulator-tests.yml@self
             parameters:
               PoolName: 1es-pool-azfunc
-              ArtifactFeed: 'internal/PythonWorker_Internal_PublicPackages'
-              NuGetServiceConnection: 'PythonWorker_Internal_PublicPackages'
       - stage: RunWorkerUnitTests
         dependsOn: BuildPythonWorker
         jobs:
           - template: /eng/templates/jobs/ci-unit-tests.yml@self
             parameters:
               PoolName: 1es-pool-azfunc
-              ArtifactFeed: 'internal/PythonWorker_Internal_PublicPackages'
-              NuGetServiceConnection: 'PythonWorker_Internal_PublicPackages'
       - stage: RunWorkerDockerDedicatedTests
         dependsOn: BuildPythonWorker
         jobs:
@@ -99,8 +95,6 @@ extends:
               PROJECT_NAME: 'Python V2 Library'
               PROJECT_DIRECTORY: 'runtimes/v2'
               PoolName: 1es-pool-azfunc
-              ArtifactFeed: 'internal/PythonWorker_Internal_PublicPackages'
-              NuGetServiceConnection: 'PythonWorker_Internal_PublicPackages'
 
       # Python V1 Library Build and Test Stages
       - stage: BuildV1Library
@@ -118,6 +112,4 @@ extends:
             parameters:
               PROJECT_NAME: 'Python V1 Library'
               PROJECT_DIRECTORY: 'runtimes/v1'
-              PoolName: 1es-pool-azfunc
-              ArtifactFeed: 'internal/PythonWorker_Internal_PublicPackages'
-              NuGetServiceConnection: 'PythonWorker_Internal_PublicPackages'
+              PoolName: 1es-pool-azfunc 

eng/ci/public-build.yml

@@ -79,25 +79,19 @@ extends:
       - template: /eng/templates/jobs/ci-dependency-check.yml@self
         parameters:
           PoolName: 1es-pool-azfunc-public
-          ArtifactFeed: 'public/PythonWorker_PublicPackages'
     - stage: RunWorkerUnitTests
       dependsOn: BuildPythonWorker
       jobs:
         - template: /eng/templates/jobs/ci-unit-tests.yml@self
           parameters:
             PROJECT_DIRECTORY: 'workers'
             PoolName: 1es-pool-azfunc-public
-            ArtifactFeed: 'public/PythonWorker_PublicPackages'
-            NuGetServiceConnection: 'PythonWorker_PublicPackages'
     - stage: RunWorkerEmulatorTests
       dependsOn: BuildPythonWorker
       jobs:
         - template: /eng/templates/jobs/ci-emulator-tests.yml@self
           parameters:
             PoolName: 1es-pool-azfunc-public
-            ArtifactFeed: 'public/PythonWorker_PublicPackages'
-            NuGetServiceConnection: 'PythonWorker_PublicPackages'
-
     # Python V2 Library Build and Test Stages
     - stage: BuildV2Library
       dependsOn: []
@@ -115,8 +109,6 @@ extends:
             PROJECT_NAME: 'V2 Library'
             PROJECT_DIRECTORY: 'runtimes/v2'
             PoolName: 1es-pool-azfunc-public
-            ArtifactFeed: 'public/PythonWorker_PublicPackages'
-            NuGetServiceConnection: 'PythonWorker_PublicPackages'
 
     # Python V1 Library Build and Test Stages
     - stage: BuildV1Library
@@ -134,6 +126,4 @@ extends:
           parameters:
             PROJECT_NAME: 'V1 Library'
             PROJECT_DIRECTORY: 'runtimes/v1'
-            PoolName: 1es-pool-azfunc-public
-            ArtifactFeed: 'public/PythonWorker_PublicPackages'
-            NuGetServiceConnection: 'PythonWorker_PublicPackages'
+            PoolName: 1es-pool-azfunc-public

eng/pack/templates/macos_64_env_gen.yml

@@ -5,9 +5,10 @@ parameters:
 
 steps:
 - task: PipAuthenticate@1
-  displayName: 'Pip Authenticate'
+  displayName: 'Authenticate pip to CFS'
   inputs:
-    artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages'
+    artifactFeeds: 'public/upstream-public'
+    onlyAddExtraIndex: false
 - task: UsePythonVersion@0
   inputs:
     versionSpec: ${{ parameters.pythonVersion }}
@@ -69,12 +70,6 @@ steps:
 #     args: '${{ parameters.pythonVersion }}'
 #   displayName: 'Build dependencies from source'
 #   condition: eq(variables['isRC'], 'true')
-- bash: |
-    pip install pip-audit
-    cd workers
-    pip-audit -r requirements.txt
-  displayName: 'Run vulnerability scan'
-  continueOnError: true
 - task: CopyFiles@2
   inputs:
     contents: '$(workerPath)'

eng/pack/templates/nix_arm64_env_gen.yml

@@ -5,9 +5,10 @@ parameters:
 
 steps:
 - task: PipAuthenticate@1
-  displayName: 'Pip Authenticate'
+  displayName: 'Authenticate pip to CFS'
   inputs:
-    artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages'
+    artifactFeeds: 'public/upstream-public'
+    onlyAddExtraIndex: false
 - task: UsePythonVersion@0
   inputs:
     versionSpec: ${{ parameters.pythonVersion }}
@@ -69,12 +70,6 @@ steps:
     args: '${{ parameters.pythonVersion }}'
   displayName: 'Build dependencies from scratch'
   condition: eq(variables['isRC'], 'true')
-- bash: |
-    pip install pip-audit
-    cd workers
-    pip-audit -r requirements.txt
-  displayName: 'Run vulnerability scan'
-  continueOnError: true
 - task: CopyFiles@2
   inputs:
     contents: '$(workerPath)'

eng/pack/templates/nix_env_gen.yml

@@ -5,9 +5,10 @@ parameters:
 
 steps:
 - task: PipAuthenticate@1
-  displayName: 'Pip Authenticate'
+  displayName: 'Authenticate pip to CFS'
   inputs:
-    artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages'
+    artifactFeeds: 'public/upstream-public'
+    onlyAddExtraIndex: false
 - task: UsePythonVersion@0
   inputs:
     versionSpec: ${{ parameters.pythonVersion }}
@@ -69,12 +70,6 @@ steps:
 #     args: '${{ parameters.pythonVersion }}'
 #   displayName: 'Build dependencies from source'
 #   condition: eq(variables['isRC'], 'true')
-- bash: |
-    pip install pip-audit
-    cd workers
-    pip-audit -r requirements.txt
-  displayName: 'Run vulnerability scan'
-  continueOnError: true
 - task: CopyFiles@2
   inputs:
     contents: '$(workerPath)'

eng/pack/templates/win_env_gen.yml

@@ -5,9 +5,10 @@ parameters:
 
 steps:
 - task: PipAuthenticate@1
-  displayName: 'Pip Authenticate'
+  displayName: 'Authenticate pip to CFS'
   inputs:
-    artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages'
+    artifactFeeds: 'public/upstream-public'
+    onlyAddExtraIndex: false
 - task: UsePythonVersion@0
   inputs:
     versionSpec: ${{ parameters.pythonVersion }}
@@ -68,12 +69,6 @@ steps:
 #     arguments: '${{ parameters.pythonVersion }}'
 #   displayName: 'Build dependencies from source'
 #   condition: eq(variables['isRC'], 'true')
-- bash: |
-    pip install pip-audit
-    cd workers
-    pip-audit -r requirements.txt
-  displayName: 'Run vulnerability scan'
-  continueOnError: true
 - task: CopyFiles@2
   inputs:
     contents: '$(workerPath)'

eng/scripts/install-dependencies.sh

@@ -1,6 +1,11 @@
 #!/bin/bash
 set -e
 
+# Forward PipAuthenticate's index URL to uv, which does not read pip's config.
+if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+  export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+fi
+
 # Install uv for faster dependency resolution / installation.
 python -m pip install --upgrade pip
 python -m pip install uv
@@ -24,7 +29,7 @@ fi
 
 # Install everything else in a single uv invocation so the resolver runs once
 # and all wheels are downloaded in parallel.
-$UV_PIP -U --prerelease=allow \
+$UV_PIP -U --prerelease=if-necessary-or-explicit \
     azure-functions \
     -e "$2/[dev]" \
     -e "$2/[test-http-v2]" \

eng/scripts/test-extensions.sh

@@ -1,14 +1,18 @@
 #!/bin/bash
 set -e
 
+if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+  export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+fi
+
 python -m pip install --upgrade pip
 python -m pip install uv
 
 UV_PIP="python -m uv pip install --system"
 
 $UV_PIP "setuptools>=62,<82.0"
 $UV_PIP -e $1/PythonExtensionArtifact/$3
-$UV_PIP --prerelease=allow -e workers/[test-http-v2]
-$UV_PIP -U --prerelease=allow -e workers/[test-deferred-bindings]
+$UV_PIP --prerelease=if-necessary-or-explicit -e workers/[test-http-v2]
+$UV_PIP -U --prerelease=if-necessary-or-explicit -e workers/[test-deferred-bindings]
 
 $UV_PIP -U -e workers/[dev]

eng/scripts/test-sdk.sh

@@ -1,6 +1,10 @@
 #!/bin/bash
 set -e
 
+if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+  export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+fi
+
 python -m pip install --upgrade pip
 python -m pip install uv
 
@@ -10,5 +14,5 @@ $UV_PIP "setuptools>=62,<82.0"
 $UV_PIP -e $1/PythonSdkArtifact
 $UV_PIP -e workers/[dev]
 
-$UV_PIP -U --prerelease=allow -e workers/[test-http-v2]
-$UV_PIP -U --prerelease=allow -e workers/[test-deferred-bindings]
+$UV_PIP -U --prerelease=if-necessary-or-explicit -e workers/[test-http-v2]
+$UV_PIP -U --prerelease=if-necessary-or-explicit -e workers/[test-deferred-bindings]

eng/templates/jobs/build.yml

@@ -19,4 +19,4 @@ jobs:
           PYTHON_VERSION: ${{ parameters.PYTHON_VERSION }}
           PROJECT_NAME: ${{ parameters.PROJECT_NAME }}
           PROJECT_DIRECTORY: ${{ parameters.PROJECT_DIRECTORY }}
-          ArtifactFeed: 'public/PythonWorker_PublicPackages'
+

eng/templates/jobs/ci-dependency-check.yml

@@ -1,6 +1,3 @@
-parameters:
-  ArtifactFeed: ''
-
 jobs:
   - job: "TestPython"
     displayName: "Run Dependency Checks"
@@ -26,9 +23,10 @@ jobs:
           PYTHON_VERSION: '3.14'
     steps:
       - task: PipAuthenticate@1
-        displayName: 'Pip Authenticate'
+        displayName: 'Authenticate pip to CFS'
         inputs:
-          artifactFeeds: ${{ parameters.ArtifactFeed }}
+          artifactFeeds: 'public/upstream-public'
+          onlyAddExtraIndex: false
       - task: UsePythonVersion@0
         inputs:
           versionSpec: $(PYTHON_VERSION)
@@ -54,6 +52,9 @@ jobs:
         displayName: 'Set necessary variables'
       - bash: |
             echo "Checking azure_functions_worker (Python < 3.13)..."
+            if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+              export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+            fi
             cd workers
             python -m pip install --upgrade pip
             python -m pip install uv
@@ -67,6 +68,9 @@ jobs:
         condition: eq(variables['proxyWorker'], false)
       - bash: |
             echo "Checking proxy_worker (Python >= 3.13)..."
+            if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+              export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+            fi
             cd workers
             python -m pip install --upgrade pip
             python -m pip install uv
@@ -79,6 +83,9 @@ jobs:
         condition: eq(variables['proxyWorker'], true)
       - bash: |
             echo "Checking V1 Library Worker (Python >= 3.13)..."
+            if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+              export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+            fi
             cd runtimes/v1
             python -m pip install --upgrade pip
             python -m pip install uv
@@ -88,6 +95,9 @@ jobs:
         condition: eq(variables['proxyWorker'], true)
       - bash: |
             echo "Checking V2 Library Worker (Python >= 3.13)..."
+            if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+              export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+            fi
             cd runtimes/v2
             python -m pip install --upgrade pip
             python -m pip install uv

eng/templates/jobs/ci-emulator-tests.yml

@@ -1,7 +1,5 @@
 parameters:
   PROJECT_DIRECTORY: 'workers'
-  ArtifactFeed: ''
-  NuGetServiceConnection: ''
 
 jobs:
   - job: "TestPython"
@@ -28,9 +26,10 @@ jobs:
           PYTHON_VERSION: '3.14'
     steps:
       - task: PipAuthenticate@1
-        displayName: 'Pip Authenticate'
+        displayName: 'Authenticate pip to CFS'
         inputs:
-          artifactFeeds: ${{ parameters.ArtifactFeed }}
+          artifactFeeds: 'public/upstream-public'
+          onlyAddExtraIndex: false
       - bash: |
           echo "Disk space before cleanup:"
           df -h
@@ -77,19 +76,7 @@ jobs:
         inputs:
           version: 10.0.x
       - task: NuGetAuthenticate@1
-        displayName: 'NuGet Authenticate'
-      - bash: |
-          # Remove the feed that doesn't match the current service connection
-          if [[ "${{ parameters.NuGetServiceConnection }}" == "PythonWorker_PublicPackages" ]]; then
-            # Remove internal feed for public builds
-            sed -i '/_Internal_PublicPackages/d' nuget.config
-          else
-            # Remove public feed for internal builds
-            sed -i '/PythonWorker_PublicPackages[^_]/d' nuget.config
-          fi
-          echo "Updated nuget.config:"
-          cat nuget.config
-        displayName: 'Configure NuGet feed for current organization'
+        displayName: 'Authenticate NuGet to CFS'
       - bash: |
           chmod +x eng/scripts/install-dependencies.sh
           eng/scripts/install-dependencies.sh $(PYTHON_VERSION) ${{ parameters.PROJECT_DIRECTORY }}