[wenyt (wenytang-ms)]

Summary

Add npm_config_registry to extends.parameters.sdl.sourceAnalysisVariablesToReset in .azure-pipelines/ci.yml, .azure-pipelines/nightly.yml, and .azure-pipelines/rc.yml. Preserve CI's existing SDL source-analysis pool and leave Build's CFS configuration, Node versions, and feed permissions unchanged.

This prevents the pipeline-wide CFS registry environment variable from overriding Guardian's feed-scoped authenticated temporary .npmrc in injected SDL source-analysis jobs. It follows the validated fix in microsoft/vscode-spring-boot-dashboard#453.

Scope audit

Audited all five pipelines on current main (a114556) using Azure Pipelines template previews:

Pipeline	Definition	Injected SDL source analysis	Action
CI	16490	Yes	Reset registry in SDL only
Nightly	16488	Yes	Reset registry in SDL only
RC	16489	Yes	Reset registry in SDL only
release-nightly	21189	No	Unchanged
release	21190	No	Unchanged

The release pipelines use 1ES templates but compile to release/tag jobs without injected SDL source analysis, so no reset is needed there.

Validation

• YAML parsing and git diff --check passed.
• Azure Pipelines previewRun: true with yamlOverride compiled all five baseline and final configurations successfully in mseng/VSJava.
• Verified the three affected pipelines retain the global CFS registry and compile an empty npm_config_registry override only in SDLSources_self.
• Compared compiled configurations: every non-SDL job in the affected pipelines is unchanged; both release configurations are unchanged. Source-level comparison confirms the only semantic additions are the requested SDL resets.
• No build/release runs were manually queued, and nothing was merged.

Limitations

This is a preventive isolation fix based on the validated cross-repository issue. No repository-specific HTTP 401 reproduction or post-fix execution run is claimed; preview compilation does not execute Guardian.