Apply CFSClean network isolation to AndroidX pipelines

[jonathanpeppers]

Summary

• configure the shared 1ES pipeline entry point with networkIsolationPolicy: Permissive,CFSClean
• retain permissive connectivity while enabling the required Centralized Feed Service policy
• preserve the pipeline-required CFSClean2 and CFSClean3 policies without adding public-feed allowlists

Rationale

This applies the required SFI/CFS network-isolation posture at extends.parameters.settings, the single shared placement used by both the official production template and unofficial PR template selection. Keeping the setting at the root avoids duplicating it across jobs or stages.

The separate azure-pipelines-public.yml entry point does not extend a 1ES pipeline template, so it is not an applicable network-isolation policy surface.

Validation

Azure DevOps AndroidX validation:

• Run 20260902.2 (15183877): expanded template logs show networkIsolationMode: Enforce with policyName: Permissive,CFSClean on generated jobs.
• The Start Network Isolation log invoked Enforce -Policies Permissive,CFSClean, selected Permissive and CFSClean from pipeline arguments, retained CFSClean2 and CFSClean3 from PerPipelineRequiredConfig, and ended with Successfully completed 'Enforce' command.
• Java 21, .NET workloads, and Android SDK/package acquisition all succeeded under isolation. The first package-generation attempt later encountered a transient HTTP 429 after resolving hundreds of Maven artifacts; it was not a network-isolation denial.
• Retry 20260902.3 (15183997) again passed network-isolation startup and all dependency installation/resolution phases and proceeded into the generated package compile.

Local YAML diff validation: git diff --check.

[Copilot]

🟢 Approval recommended

The change is minimal, syntactically valid in context, and aligns with the described template-level placement/validation for enforcing the intended network isolation policy.

Pull request overview

Updates the shared Azure DevOps pipeline entry point to apply the required CFS/SFI network isolation posture for AndroidX builds via the 1ES template extends.parameters.settings surface, without duplicating settings across jobs/stages.

Changes:

• Added settings.networkIsolationPolicy: Permissive,CFSClean under the 1ES template extends.parameters in azure-pipelines.yml.

File summaries

File	Description
azure-pipelines.yml	Adds the 1ES settings.networkIsolationPolicy parameter so generated jobs run under the intended network isolation policy set.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[jonathanpeppers]

CI validation results:

• Public PR pipeline 20260902.1 (1578837): passed.
• Trusted AndroidX pipeline 20260902.3 (15183997): the Windows build, dependency acquisition, standard package tests, and SDL source analysis all passed.
• The expanded/start-network-isolation logs confirmed Enforce -Policies Permissive,CFSClean; effective policies also retained pipeline-required CFSClean2 and CFSClean3.
• The trusted pipeline's overall result is red only because the later signing stage hit the existing MicroBuild TestSigner failure (StringDictionaryWrapper.Add: Value does not fall within the expected range), followed by NU3004 verification errors. Recent main builds show the same signing failure, so this is unrelated to the CFSClean change.

The first trusted attempt (15183877) hit a transient HTTP 429 during Binderator resolution; the retry completed package generation, build, and tests successfully under network isolation.

[jonathanpeppers]

@dalexsoto review

[dalexsoto]

Validated the shared 1ES settings placement and end-to-end pipeline behavior: CFSClean is enforced alongside the required CFSClean2/3 policies, and the observed signing failure reproduces on main.