Route metadata/OpenAPI capture jobs through CFS feeds (CFSClean)

Pipeline 79 (Generation) fails CFSClean because the capture-metadata and capture-openapi jobs reach public package feeds: dotnet restore/tool-install -> api.nuget.org and npm install -> registry.npmjs.org. PR #1448 only covered the typewriter/kiota stages and wrote nuget.config to the sources dir, where a later 'checkout: self' wipes it.

Add reusable create-cfs-nuget-config.yml (NuGetAuthenticate + nuget.config written to Agent.TempDirectory so checkout cannot wipe it) and create-cfs-npmrc.yml (npmAuthenticate + CFS npm registry applied to the user profile). Wire both into capture-metadata.yml (after checkouts) and the nuget config into capture-openapi's convert_openapi job, and pass --configfile to the hidi 'dotnet tool install' steps. Feed: GraphDeveloperExperiences_Public (upstreams nuget.org and npmjs.org).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188

Author: gavinbarron

.azure-pipelines/generation-templates/capture-metadata.yml

@@ -48,6 +48,11 @@ steps:
 - template: /.azure-pipelines/generation-templates/checkout-metadata.yml@self
 - template: /.azure-pipelines/generation-templates/set-user-config.yml@self
 
+# Route NuGet and npm through the CFS central feed for 1ES network isolation (CFSClean).
+# Placed after all checkouts so the generated config files are not wiped by a checkout clean.
+- template: /.azure-pipelines/generation-templates/create-cfs-nuget-config.yml@self
+- template: /.azure-pipelines/generation-templates/create-cfs-npmrc.yml@self
+
 # required for TypeSpec
 - task: UseNode@1
   inputs:
@@ -153,7 +158,7 @@ steps:
   parameters:
     version: '9.x'
 
-- pwsh: dotnet tool install --global Microsoft.OpenApi.Hidi --version 1.*
+- pwsh: dotnet tool install --global Microsoft.OpenApi.Hidi --version 1.* --configfile "$(Agent.TempDirectory)/nuget.config"
   displayName: 'Install hidi tool'
 
 # verify that generated metadata is parsable as an Edm model

.azure-pipelines/generation-templates/capture-openapi.yml

@@ -61,6 +61,9 @@ jobs:
     persistCredentials: true
 
   - template: /.azure-pipelines/generation-templates/checkout-metadata.yml@self
+  # Route NuGet through the CFS central feed for 1ES network isolation (CFSClean).
+  # Placed after all checkouts so the generated config is not wiped by a checkout clean.
+  - template: /.azure-pipelines/generation-templates/create-cfs-nuget-config.yml@self
   # required for the hidi to run
   - template: /.azure-pipelines/generation-templates/use-dotnet-sdk.yml@self
     parameters:
@@ -71,7 +74,7 @@ jobs:
     parameters:
       version: '9.x'
 
-  - pwsh: dotnet tool install --global Microsoft.OpenApi.Hidi --version 1.*
+  - pwsh: dotnet tool install --global Microsoft.OpenApi.Hidi --version 1.* --configfile "$(Agent.TempDirectory)/nuget.config"
     displayName: install hidi
 
   - pwsh: |

.azure-pipelines/generation-templates/create-cfs-npmrc.yml

@@ -0,0 +1,20 @@
+# Routes npm through the CFS central feed (GraphDeveloperExperiences_Public, which upstreams
+# npmjs.org) instead of hitting registry.npmjs.org directly, for 1ES network isolation (CFSClean).
+# The authenticated .npmrc is copied to the user profile so both global (`npm install -g`) and
+# project (`npm ci`) commands pick up the registry + credentials without per-step configuration.
+steps:
+- pwsh: |
+    @"
+    registry=https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public/npm/registry/
+    always-auth=true
+    "@ | Set-Content -Path "$(Agent.TempDirectory)/.npmrc" -Encoding UTF8
+  displayName: 'Create .npmrc (CFS central feed)'
+
+- task: npmAuthenticate@0
+  displayName: 'Authenticate npm to CFS feed'
+  inputs:
+    workingFile: '$(Agent.TempDirectory)/.npmrc'
+
+- pwsh: |
+    Copy-Item -Path "$(Agent.TempDirectory)/.npmrc" -Destination (Join-Path $HOME '.npmrc') -Force
+  displayName: 'Apply CFS .npmrc to user profile'

.azure-pipelines/generation-templates/create-cfs-nuget-config.yml

@@ -0,0 +1,20 @@
+# Routes dotnet/NuGet restore and tool installs through the CFS central package feed
+# (GraphDeveloperExperiences_Public) instead of public nuget.org, for 1ES network isolation
+# (CFSClean). The config is written to $(Agent.TempDirectory) so it survives any subsequent
+# `checkout` step (which cleans the sources directory and would wipe a config placed there).
+# Consumers must pass `--configfile "$(Agent.TempDirectory)/nuget.config"` to dotnet commands.
+steps:
+- task: NuGetAuthenticate@1
+  displayName: 'Authenticate to Azure Artifacts (CFS feed)'
+
+- pwsh: |
+    @"
+    <?xml version="1.0" encoding="utf-8"?>
+    <configuration>
+      <packageSources>
+        <clear />
+        <add key="GraphDeveloperExperiences_Public" value="https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public/nuget/v3/index.json" />
+      </packageSources>
+    </configuration>
+    "@ | Set-Content -Path "$(Agent.TempDirectory)/nuget.config" -Encoding UTF8
+  displayName: 'Create nuget.config (CFS central feed)'