[wenyt (wenytang-ms)]

Summary

Add npm_config_registry to extends.parameters.sdl.sourceAnalysisVariablesToReset in CI, Nightly and RC. This isolates SDL/Guardian from the Build-only global CFS registry.

Preserve global Build CFS routing, all existing sourceAnalysisPool/pool settings, SpotBugs and network-isolation settings where present, Node versions and permissions. Release YAMLs are unchanged.

Validation

• Parsed the actual source YAML and checked its diff against main at c9438a0719a4ca232d597e8a7b57b1df4a9c2622.
• Baseline/final previewRun:true + yamlOverride compilations succeeded for every enabled source definition: 15770, 15776, 23362, with self fixed to that SHA.
• Whole-document comparison confirms the only compiled change is npm_config_registry: '' in SDLSources_self; all other compiled content is identical.
• All enabled release definitions (21772, 21773) compiled without SDL source analysis, so their YAMLs remain unchanged.
• git diff --check passed.

Scope and limitations

This is the same narrow isolation used in microsoft/vscode-spring-boot-dashboard#453.

Preview compiles but does not execute Guardian/feed authentication. No repository-specific npm6/E401 reproduction or post-fix runtime success is claimed. No build or release was manually queued.

[Changyong Gong (chagong)]

Reviewed the complete diff and pipeline context. The change only resets npm_config_registry in SDL source analysis for CI, Nightly and RC, preserving Build CFS routing, existing pools/SDL configuration, Node versions, permissions and release YAMLs. No blocking code issues found. Azure SDL/CFS checks were still running at review time; this approval does not replace those checks or independently confirm runtime Guardian authentication.