Use approved npm feed for Dependabot

[Eduardo Villalpando Mello (edvilme)]

Summary - configure Dependabot npm updates to use the team-owned Pylance_PublicPackages Azure Artifacts feed - authenticate with Azure OIDC using the identity pattern established by microsoft/pyrx#9310 - retain the seven-day npm cooldown because @vscode/python-environments still uses an explicit feed URL that replaces-base cannot redirect - retain the seven-day pip cooldown until an approved Python-feed path is confirmed - remove the project .npmrc that forced Dependabot back to public npm ## Required infrastructure Do not remove no-merge until the managed identity has feed access and a Dependabot federated credential for this repository. The credential must use issuer https://token.actions.msft.ghe.com, audience api://AzureADTokenExchange, and the exact repository subject emitted by Dependabot. The tenant and client IDs are identifiers, not secrets.

[Bill Schnurr (bschnurr)]

🔒 Automated review in progress — Bill Schnurr (@bschnurr) is auto-reviewing this PR.

[Bill Schnurr (bschnurr)]

Result: ⚠️ needs-more-tests

Verification details

Verification: The relevant tests could not be fully run in the isolated environment; this review is not fully verified.

Summary: A Python smoke test successfully parsed the Dependabot YAML and verified the intended registry, OIDC identifiers, cooldown behavior, and `.npmrc` removal. The Prettier check timed out, and no repository tests cover the new Azure OIDC authentication path. An actual Dependabot update could not be exercised without the required managed identity and feed access. Confidence is therefore limited.

Test runs: 2 passed, 2 not run

• ⚠️ Not run | Prettier check for Dependabot configuration | node external/vscode-common-python-lsp/typescript/node_modules/prettier/bin/prettier.cjs --check .github/dependabot.yml
• ⚠️ Not run | Ruby Dependabot configuration smoke test | ruby -e 'require "yaml"; p=".github/dependabot.yml"; d=YAML.safe_load(File.read(p)); r=d.fetch("registries").fetch("pylance-public-packages"); raise "wrong registry type" unless r["type"]=="npm-registry"; raise "wrong feed URL" unless r["url"]=="https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/Pylance_PublicPackages/npm/registry/"; raise "OIDC identifiers missing" unless r.values_at("tenant-id","client-id").all?{|v| v.is_a?(String) && !v.empty?}; raise "registry must replace npm base" unless r["replaces-base"]==true; npm=d.fetch("updates").find{|u| u["package-ecosystem"]=="npm"}; pip=d.fetch("updates").find{|u| u["package-ecosystem"]=="pip"}; raise "npm registry not enabled" unless npm["registries"]=="*"; raise "npm cooldown retained" if npm.key?("cooldown"); raise "pip cooldown changed" unless pip.dig("cooldown","default-days")==7; raise ".npmrc still present" if File.exist?(".npmrc"); puts "Dependabot YAML parsed; npm registry/OIDC, cooldown, pip retention, and .npmrc removal assertions passed"'
• ✅ Passed | Dependency and test discovery | printf '%s\n' '--- sandbox profile ---'; printf '%s\n' "${AUTOMATION_SANDBOX_PROFILE:-unset}"; printf '%s\n' '--- changed files ---'; git diff --name-status HEAD^ HEAD; printf '%s\n' '--- dependency state ---'; test -d node_modules && echo 'node_modules: present' || echo 'node_modules: missing'; test -d external/vscode-common-python-lsp/typescript/node_modules && echo 'shared node_modules: present' || echo 'shared node_modules: missing'; printf '%s\n' '--- relevant scripts/tests ---'; node -e "const p=require('./package.json'); console.log(JSON.stringify({scripts:p.scripts},null,2))"; find . -path './.git' -prune -o ( -iname 'dependabottest*' -o -iname 'yamltest*' -o -iname 'configtest*' ) -print | head -80
• ✅ Passed | Dependabot configuration semantic smoke test | python -c 'from pathlib import Path; import yaml; p=Path(".github/dependabot.yml"); d=yaml.safe_load(p.read_text()); r=d["registries"]["pylance-public-packages"]; assert r["type"] == "npm-registry"; assert r["url"] == "https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/Pylance_PublicPackages/npm/registry/"; assert all(isinstance(r[k], str) and r[k] for k in ("tenant-id", "client-id")); assert r["replaces-base"] is True; npm=next(u for u in d["updates"] if u["package-ecosystem"] == "npm"); pip=next(u for u in d["updates"] if u["package-ecosystem"] == "pip"); assert npm["registries"] == "*"; assert "cooldown" not in npm; assert pip["cooldown"]["default-days"] == 7; assert not Path(".npmrc").exists(); print("Dependabot YAML parsed; npm registry/OIDC, cooldown, pip retention, and .npmrc removal assertions passed")'

⚠️ Prettier check for Dependabot configuration diagnostic output

Command timed out after 120s; the sandbox container was destroyed.

⚠️ Ruby Dependabot configuration smoke test diagnostic output

/bin/sh: 1: ruby: not found

[Bill Schnurr (bschnurr)]

Approved via Review Center.

[Bill Schnurr (bschnurr)]

Result: ⚠️ needs-more-tests

Verification details

Verification: Isolated verification observed failures that were not classified as caused by this PR: Dependabot configuration semantic assertions. The relevant tests could not be fully run in the isolated environment; this review is not fully verified.

Summary: The repository’s existing Prettier configuration check passed, including `.github/dependabot.yml`. Offline dependency installation also succeeded. No tests were added by the PR. Semantic assertions could not run because the unavailable `yaml` module blocked the ad-hoc check, and the actual Dependabot OIDC/feed authentication requires external infrastructure, leaving the core behavior unverified.

Test runs: 1 passed, 1 failed, 1 not run

• ❌ Failed | unrelated to this PR | Dependabot configuration semantic assertions | node <<'NODE'
const fs = require('fs');
const YAML = require('yaml');
const config = YAML.parse(fs.readFileSync('.github/dependabot.yml', 'utf8'));
// Assertions for registry, OIDC identifiers, update linkage, cooldowns, lockfile URL, and .npmrc removal.
NODE
• ⚠️ Not run | Authenticated Dependabot npm update | Not available locally; requires a Dependabot version-update job with the configured Azure OIDC credential
• ✅ Passed | Prettier format check | npm run format-check

❌ Dependabot configuration semantic assertions diagnostic output

Error: Cannot find module 'yaml'
Require stack:
- /workspace/[stdin]
Node.js v24.17.0

⚠️ Authenticated Dependabot npm update diagnostic output

The credential and feed-access path cannot be exercised in the network-isolated verification environment.

[Bill Schnurr (bschnurr)]

Result: ⚠️ partially-verified

Verification details

Verification: The relevant tests could not be fully run in the isolated environment; this review is not fully verified.

Summary: Targeted checks passed: the Dependabot YAML is formatted and parses with the intended Azure OIDC registry, npm association, cooldowns, and `.npmrc` removal. Offline `npm ci` installed 643 packages successfully. The PR adds no tests. Live Dependabot authentication and feed access could not be exercised in the credential-free offline container, so verification is partial.

Test runs: 4 passed

• ✅ Passed | Prettier check for Dependabot configuration | node ./node_modules/prettier/bin/prettier.cjs --check .github/dependabot.yml
• ✅ Passed | Environment and dependency discovery | printf 'profile=%s\n' "${AUTOMATION_SANDBOX_PROFILE:-unset}"; git diff --name-status HEAD^ HEAD; printf '%s\n' '--- dependency availability ---'; test -d node_modules && echo 'root node_modules: present' || echo 'root node_modules: missing'; test -d external/vscode-common-python-lsp/typescript/node_modules && echo 'shared node_modules: present' || echo 'shared node_modules: missing'; node --version; npm --version; python - <<'PY'
try:
import yaml
print('PyYAML: present', yaml.version)
except Exception as exc:
print('PyYAML: missing', repr(exc))
PY
• ✅ Passed | Offline npm dependency bootstrap | npm ci --offline --ignore-scripts
• ✅ Passed | Dependabot registry configuration assertions | python - <<'PY'
from pathlib import Path
import yaml

path = Path('.github/dependabot.yml')
data = yaml.safe_load(path.read_text(encoding='utf-8'))
assert data['version'] == 2
registry = data['registries']['pylance-public-packages']
assert registry == {
'type': 'npm-registry',
'url': 'https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/Pylance_PublicPackages/npm/registry/',
'tenant-id': '72f988bf-86f1-41af-91ab-2d7cd011db47',
'client-id': '92c669e8-02ad-4ce6-ad73-f222fc7177e2',
'replaces-base': True,
}
updates = {entry['package-ecosystem']: entry for entry in data['updates']}
assert updates['npm']['registries'] == ['pylance-public-packages']
assert updates['npm']['cooldown']['default-days'] == 7
assert updates['pip']['cooldown']['default-days'] == 7
assert not Path('.npmrc').exists()
print('Dependabot YAML parsed successfully; Azure OIDC registry, npm association, both cooldowns, and .npmrc removal verified.')
PY

[Bill Schnurr (bschnurr)]

Result: ⚠️ needs-more-tests

Verification details

Verification: Isolated verification observed failures that were not classified as caused by this PR: Dependabot configuration semantic assertions.

Summary: The targeted Prettier check passed for `.github/dependabot.yml`, and offline dependency installation succeeded. No tests were added by the PR. A semantic assertion could not run because the repository lacks the attempted `yaml` module; this was unrelated to the PR. Dependabot's Azure OIDC authentication and feed access remain unverified.

Test runs: 3 passed, 1 failed

• ❌ Failed | unrelated to this PR | Dependabot configuration semantic assertions | node - <<'NODE'
const fs = require('fs');
const YAML = require('yaml');
const config = YAML.parse(fs.readFileSync('.github/dependabot.yml', 'utf8'));
const registry = config.registries?.['pylance-public-packages'];
if (config.version !== 2) throw new Error('Dependabot version must be 2');
if (registry?.type !== 'npm-registry') throw new Error('npm registry type missing');
if (registry.url !== 'https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/Pylance_PublicPackages/npm/registry/&#x27;) throw new Error('approved feed URL mismatch');
if (registry['tenant-id'] !== '72f988bf-86f1-41af-91ab-2d7cd011db47') throw new Error('tenant ID mismatch');
if (registry['client-id'] !== '92c669e8-02ad-4ce6-ad73-f222fc7177e2') throw new Error('client ID mismatch');
if (registry['replaces-base'] !== true) throw new Error('replaces-base must be true');
const npm = config.updates.find((u) => u['package-ecosystem'] === 'npm');
const pip = config.updates.find((u) => u['package-ecosystem'] === 'pip');
if (!npm?.registries?.includes('pylance-public-packages')) throw new Error('npm update does not reference registry');
if (npm.cooldown?.['default-days'] !== 7 || pip?.cooldown?.['default-days'] !== 7) throw new Error('seven-day cooldown changed');
if (fs.existsSync('.npmrc')) throw new Error('.npmrc still exists');
console.log('Dependabot YAML parsed; approved npm registry, OIDC identifiers, registry reference, cooldowns, and .npmrc removal verified.');
NODE
• ✅ Passed | Prettier check for Dependabot configuration | node ./node_modules/prettier/bin/prettier.cjs --check .github/dependabot.yml
• ✅ Passed | Dependency and test discovery | printf 'sandbox=%s\n' "${AUTOMATION_SANDBOX_PROFILE:-}"; git diff --name-status HEAD^ HEAD; printf '\nnode_modules='; if [ -d node_modules ]; then echo present; else echo missing; fi; printf 'shared_node_modules='; if [ -d external/vscode-common-python-lsp/typescript/node_modules ]; then echo present; else echo missing; fi; printf '\nlockfiles/manifests:\n'; find . -maxdepth 2 -type f ( -name 'package-lock.json' -o -name 'pnpm-lock.yaml' -o -name 'yarn.lock' -o -name 'package.json' ) -print | sort; printf '\nrelevant scripts:\n'; node -e "const p=require('./package.json'); console.log(JSON.stringify({formatCheck:p.scripts?.['format-check']},null,2))"; printf '\nconfig-related tests:\n'; find . -type f ( -iname 'dependabottest*' -o -iname 'dependabotspec*' ) -print | head -50
• ✅ Passed | Offline npm dependency bootstrap | npm ci --offline --ignore-scripts

❌ Dependabot configuration semantic assertions diagnostic output

Error: Cannot find module 'yaml'
Require stack:
- /workspace/[stdin]
code: 'MODULE_NOT_FOUND'
Node.js v24.17.0