ci: onboard PowerShell pipelines (187/221/663) to network isolation enforcement (CFSClean) (#3732)

* ci: TEMPORARY CFSClean diagnostic - dump npmjs tarball resolutions

After `rush install`, print the entries in the re-resolved
common/temp/pnpm-lock.yaml that resolved to registry.npmjs.org, to
identify exactly which package(s) egress to public npm under 1ES
network isolation. To be reverted once the culprits are identified.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0

* ci: diagnostic v2 - list pnpm metadata cache entries from npmjs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0

* ci: TEMP enforce network isolation (no Npm) + skip generation for npmjs diagnostic

Enforce networkIsolationMode with policy Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3
(deliberately omitting Npm) so public registry.npmjs.org egress is blocked and the failing pnpm
fetch names the culprit package. Generation/downstream steps disabled to keep the build fast.
To be reverted before merge.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0

* ci: onboard PowerShell V2 Build to network isolation enforcement (CFSClean)

Revert the exploratory diagnostic + generation-disable changes; keep only the network
isolation settings. Enforce mode with policy
Good,GitHub,Npm,NuGet,PowershellGallery,CFSClean,CFSClean3 onboards the pipeline to 1ES
network isolation for CFSClean/SFI compliance. Validated on branch build 234324: all
policies (CFSClean, CFSClean2, CFSClean3, Default Deny) reported COMPLIANT and the build
succeeded.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0

* ci: drop Npm from network isolation policy (block public npmjs)

Removes Npm from the allowlist so public registry.npmjs.org is blocked under enforcement.
Validated in build 234324: build succeeds and all CFSClean tiers report COMPLIANT with npmjs blocked.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0

* ci: onboard Weekly (221) and Command-Metadata-Refresh (663) to network isolation enforcement

Apply the same network isolation settings as ci-build.yml (187): Enforce mode with policy
Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3. 663 previously set networkIsolationPolicy:
Permissive; this switches it to enforcement. All three pipelines share install-tools.yml, so the
same CFSClean posture applies.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Ramses Sanchez-Hernandez <63934382+ramsessanchez@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0

Author: 3 people

.azure-pipelines/ci-build.yml

@@ -51,6 +51,12 @@ extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
   parameters:
     pool: $(BuildAgent)
+    # Onboard to 1ES network isolation enforcement for CFSClean / SFI compliance. Enforce mode with an
+    # allowlist for the package ecosystems this build uses so it resolves from approved feeds while
+    # non-allowlisted public egress is blocked.
+    settings:
+      networkIsolationMode: Enforce
+      networkIsolationPolicy: Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3
     sdl:
       binskim:
         enabled: false

.azure-pipelines/command-metadata-refresh.yml

@@ -58,8 +58,12 @@ extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
   parameters:
     pool: $(BuildAgent)
+    # Onboard to 1ES network isolation enforcement for CFSClean / SFI compliance. Enforce mode with an
+    # allowlist for the package ecosystems this build uses so it resolves from approved feeds while
+    # non-allowlisted public egress is blocked.
     settings:
-      networkIsolationPolicy: Permissive
+      networkIsolationMode: Enforce
+      networkIsolationPolicy: Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3
     sdl:
       binskim:
         enabled: false

.azure-pipelines/weekly-generation.yml

@@ -61,6 +61,12 @@ extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
   parameters:
     pool: $(BuildAgent)
+    # Onboard to 1ES network isolation enforcement for CFSClean / SFI compliance. Enforce mode with an
+    # allowlist for the package ecosystems this build uses so it resolves from approved feeds while
+    # non-allowlisted public egress is blocked.
+    settings:
+      networkIsolationMode: Enforce
+      networkIsolationPolicy: Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3
     sdl:
       binskim:
         enabled: false