From f68018de4fc63d47e1711f18d14b086925da1f38 Mon Sep 17 00:00:00 2001 From: "Kaveesh Dubey (from Dev Box)" Date: Thu, 23 Jul 2026 12:00:37 -0700 Subject: [PATCH] Onboard build pipeline to CFS network isolation (CFSClean) in audit mode SFI Network Isolation / MountainPass SR21: add the CFSClean policy in Permissive (audit) mode so the pipeline reports public package-feed violations without failing the build. Drop 'Permissive' to flip to enforcing once builds are violation-free. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7b30a2b2-5c35-4661-ae49-2edacdb00952 --- .pipelines/azure_pipeline_mergedbranches.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.pipelines/azure_pipeline_mergedbranches.yaml b/.pipelines/azure_pipeline_mergedbranches.yaml index e1057a49f..a805ce8b2 100644 --- a/.pipelines/azure_pipeline_mergedbranches.yaml +++ b/.pipelines/azure_pipeline_mergedbranches.yaml @@ -35,6 +35,11 @@ resources: extends: template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates parameters: + # SFI SR21 (MountainPass): onboard to CFS network isolation in AUDIT mode. + # 'Permissive' reports public-feed (CFSClean) violations without failing the + # build. Drop 'Permissive' to flip to enforcing once builds are violation-free. + settings: + networkIsolationPolicy: Permissive,CFSClean pool: name: Azure-Pipelines-CI-Test-EO image: ci-1es-managed-ubuntu-2204