[wenyt (wenytang-ms)]

Summary

Add npm_config_registry to extends.parameters.sdl.sourceAnalysisVariablesToReset in CI, Nightly and RC. This isolates SDL/Guardian from the Build-only global CFS registry.

Preserve global Build CFS routing, all existing sourceAnalysisPool/pool settings, SpotBugs and network-isolation settings where present, Node versions and permissions. Release YAMLs are unchanged.

Validation

• Parsed the actual source YAML and checked its diff against main at e9526f180260a4f9ed682c34953af35c66ca6937.
• Baseline/final previewRun:true + yamlOverride compilations succeeded for every enabled source definition: 16482, 16483, 23369, with self fixed to that SHA.
• Whole-document comparison confirms the only compiled change is npm_config_registry: '' in SDLSources_self; all other compiled content is identical.
• All enabled release definitions (21191, 21192) compiled without SDL source analysis, so their YAMLs remain unchanged.
• git diff --check passed.

Scope and limitations

This is the same narrow isolation used in microsoft/vscode-spring-boot-dashboard#453.

Preview compiles but does not execute Guardian/feed authentication. No repository-specific npm6/E401 reproduction or post-fix runtime success is claimed. No build or release was manually queued.

[Changyong Gong (chagong)]

No blocking issue found in the YAML diff: the registry reset is SDL-only, with Build CFS routing, Node versions, pools, permissions and release YAMLs unchanged. The Azure SDL and CFS dependency-validation checks pass.

Withholding approval for now because three macOS E2E jobs remain red:

• java-gradle-java25: the report shows missing Java 25 compiler preferences and a Buildship project nature instead of the expected Gradle build-server nature.
• java-gradle-java27: the expected compiler.source=27 entry is absent from the JDT preferences file.
• java27-primitive-patterns: output verification for REOPEN_INSERTION_CONFIRMED reports an error.

These failures occur in GitHub Actions, outside the modified Azure SDL configuration, and appear unrelated to this change. However, today's main-branch baseline has different failures, not these same three, so I cannot confidently label them established baseline failures. Please triage/rerun these jobs or provide evidence that they are pre-existing before approval.