[wenyt (wenytang-ms)]

Summary

Add npm_config_registry to extends.parameters.sdl.sourceAnalysisVariablesToReset in CI, Nightly and RC. This isolates SDL/Guardian from the Build-only global CFS registry while preserving Build routing, sourceAnalysisPool, existing networkIsolationPolicy, Node versions and permissions. Release YAMLs are unchanged.

Validation

Parsed the actual source YAML and checked its diff against main 6360cc0. Baseline/final previewRun:true + yamlOverride compilations succeeded for every enabled source definition: 16478, 16479 and 16480, with self fixed to that SHA. Whole-document comparison confirms the only compiled change is npm_config_registry: '' in SDLSources_self; all other content is identical. Release definitions 21458 and 21459 compiled without SDL source analysis. git diff --check passed.

Scope and limitations

This is preventive isolation based on microsoft/vscode-spring-boot-dashboard#453. Preview compiles but does not execute Guardian/feed authentication; no repository-specific npm6/E401 reproduction or post-fix runtime success is claimed. No build or release was manually queued.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[wenyt (wenytang-ms)]

Closing this duplicate of #1117, which is already merged. Both PRs use the same source branch and head commit; there are no additional changes to merge.