From dff15831bf02329cb472f94ae0f8e09665ddbd0c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Aug 2026 03:47:21 +0000
Subject: [PATCH 1/2] Enforce CFSClean network isolation

Co-authored-by: mikeharder <9459391+mikeharder@users.noreply.github.com>
---
 eng/pipelines/templates/stages/1es-redirect.yml | 1 +
 eng/pipelines/templates/steps/set-env.yaml      | 7 +++----
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/eng/pipelines/templates/stages/1es-redirect.yml b/eng/pipelines/templates/stages/1es-redirect.yml
index f803fdacd..60c3eb36d 100644
--- a/eng/pipelines/templates/stages/1es-redirect.yml
+++ b/eng/pipelines/templates/stages/1es-redirect.yml
@@ -21,6 +21,7 @@ extends:
   parameters:
     settings:
       skipBuildTagsForGitHubPullRequests: true
+      networkIsolationPolicy: Permissive, CFSClean
     sdl:
       # Uncomment when needed
       # credscan:
diff --git a/eng/pipelines/templates/steps/set-env.yaml b/eng/pipelines/templates/steps/set-env.yaml
index 175f95660..b5e1c3629 100644
--- a/eng/pipelines/templates/steps/set-env.yaml
+++ b/eng/pipelines/templates/steps/set-env.yaml
@@ -20,10 +20,9 @@ steps:
   - script: npm install -g cspell
     displayName: Install cspell
 
-  - script: |
-      npm i -g corepack@latest
-      corepack enable
-      corepack prepare pnpm@latest-10 --activate
+  - pwsh: |
+      $packageJson = Get-Content -Raw "$(TypeSpecRustPkgDir)/package.json" | ConvertFrom-Json
+      npm install -g $packageJson.packageManager
     displayName: Install pnpm
 
   - script: pnpm config set store-dir ${{ parameters.pnpmStorePath }}

From f081e362d51b9984253a63d54345cfcd62571749 Mon Sep 17 00:00:00 2001
From: Daniel Jurek <djurek@microsoft.com>
Date: Fri, 7 Aug 2026 10:51:09 -0700
Subject: [PATCH 2/2] Route cargo through the azure-sdk-for-rust CFS feed

CFSClean network isolation blocks direct crates.io access, so cargo must
resolve crates through the azure-sdk-for-rust feed instead.

Add config-cargo.yml to set-env.yaml, the shared step template included by
all four registered pipelines (ci, publish-release, typespec-spector, and
ci-typespec-nightly). All cargo invocations live in build-test.yaml, which
always runs after set-env.yaml, so a single reference covers every pipeline.

Also move config.toml.template from eng/template to eng/templates to match
the path config-cargo.yml copies from and the azure-sdk-for-rust layout.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8d9f988a-e7bc-4959-a467-789804f3221c
---
 .../templates/steps/config-cargo.yml          | 21 +++++++++++
 eng/pipelines/templates/steps/set-env.yaml    |  2 +
 eng/templates/config.toml.template            | 37 +++++++++++++++++++
 3 files changed, 60 insertions(+)
 create mode 100644 eng/pipelines/templates/steps/config-cargo.yml
 create mode 100644 eng/templates/config.toml.template

diff --git a/eng/pipelines/templates/steps/config-cargo.yml b/eng/pipelines/templates/steps/config-cargo.yml
new file mode 100644
index 000000000..de3a0d855
--- /dev/null
+++ b/eng/pipelines/templates/steps/config-cargo.yml
@@ -0,0 +1,21 @@
+steps:
+  - pwsh: |
+      $cargoHome = $env:CARGO_HOME
+      if (-not $cargoHome) { $cargoHome = ([System.IO.Path]::Combine($HOME, '.cargo')) }
+      New-Item -ItemType Directory -Force -Path $cargoHome | Out-Null
+
+      $configPath = ([System.IO.Path]::Combine($cargoHome, 'config.toml'))
+      Copy-Item `
+        -Path '$(Build.SourcesDirectory)/eng/templates/config.toml.template' `
+        -Destination $configPath `
+        -Force
+
+      Write-Host "Wrote cargo config to $configPath"
+      Get-Content $configPath
+      Write-Host "##vso[task.setvariable variable=CargoConfigPath]$configPath"
+    displayName: Configure cargo to use the azure-sdk-for-rust feed
+
+  - task: CargoAuthenticate@0
+    displayName: Authenticate cargo to the azure-sdk-for-rust feed
+    inputs:
+      configFile: $(CargoConfigPath)
diff --git a/eng/pipelines/templates/steps/set-env.yaml b/eng/pipelines/templates/steps/set-env.yaml
index b5e1c3629..b448de601 100644
--- a/eng/pipelines/templates/steps/set-env.yaml
+++ b/eng/pipelines/templates/steps/set-env.yaml
@@ -40,3 +40,5 @@ steps:
       rustup default ${{ parameters.rustVersion }}
       rustup show
     displayName: Install Rust
+
+  - template: /eng/pipelines/templates/steps/config-cargo.yml
diff --git a/eng/templates/config.toml.template b/eng/templates/config.toml.template
new file mode 100644
index 000000000..4b09f95c0
--- /dev/null
+++ b/eng/templates/config.toml.template
@@ -0,0 +1,37 @@
+# Cargo configuration used by CI builds to route crates.io traffic through the
+# Centralized Feed Service (CFS) instead of the public internet.
+#
+# This file should be copied to $CARGO_HOME/config.toml
+#
+# CargoAuthenticate@0 parses the [registries] table below and exports the
+# CARGO_REGISTRIES_AZURE_SDK_FOR_RUST_TOKEN / _CREDENTIAL_PROVIDER variables that cargo
+# needs to authenticate against the feed. The feed sets "auth-required": true, so the
+# token is required even for reads.
+#
+# The [source] replacement redirects index.crates.io and static.crates.io to the
+# feed.
+#
+[registries]
+azure-sdk-for-rust = { index = "sparse+https://pkgs.dev.azure.com/azure-sdk/_packaging/azure-sdk-for-rust/Cargo/index/" }
+
+[source.crates-io]
+replace-with = "azure-sdk-for-rust"
+
+# Both `cargo package` and `cargo publish` refuse to run while crates-io is replaced
+# unless the target registry is named, failing with:
+#
+#   error: crates-io is replaced with remote registry azure-sdk-for-rust;
+#   include `--registry azure-sdk-for-rust` or `--registry crates-io`
+#
+# The target registry must be the replacement, not crates-io. When packaging several
+# workspace members at once, cargo satisfies their unpublished inter-member versions
+# (for example typespec_client_core depending on typespec ^1.2.0-beta.1) from the crates
+# it just packaged. That overlay is only consulted when the target registry matches the
+# source deps resolve through, so `--registry crates-io` still fails to find them.
+#
+# Setting the default here keeps eng/scripts/Pack-Crates.ps1 free of CI-only flags, so
+# it behaves identically for local developers. Nothing publishes for real from cargo:
+# the only `cargo publish` in the repo is Pack-Crates.ps1's `--dry-run` validation, and
+# releases ship through ESRP.
+[registry]
+default = "azure-sdk-for-rust"