Use locked VSCE installs and verify VSIX signatures

Build/package/cpptools_extension_pack.yml

@@ -32,7 +32,9 @@ extends:
         image: 1ESPT-Windows2025
         os: windows
     settings:
-      networkIsolationPolicy: CFSClean,CFSClean2,CFSClean3
+      # CFSClean* supplies deny rules only; a base allow policy is also needed
+      # for Azure DevOps authentication and package downloads.
+      networkIsolationPolicy: Permissive,CFSClean,CFSClean2,CFSClean3
 
     stages:
     - stage: package

Build/package/cpptools_themes.yml

@@ -32,7 +32,9 @@ extends:
         image: 1ESPT-Windows2025
         os: windows
     settings:
-      networkIsolationPolicy: CFSClean,CFSClean2,CFSClean3
+      # CFSClean* supplies deny rules only; a base allow policy is also needed
+      # for Azure DevOps authentication and package downloads.
+      networkIsolationPolicy: Permissive,CFSClean,CFSClean2,CFSClean3
 
     stages:
     - stage: package

Build/package/jobs_package_vsix.yml

@@ -29,6 +29,10 @@ jobs:
       displayName: '${{ parameters.vsixName }}.vsix'
       targetPath: $(Build.ArtifactStagingDirectory)\vsix
       artifactName: vsix
+    - output: pipelineArtifact
+      displayName: Locked VSCE dependencies
+      targetPath: $(Build.ArtifactStagingDirectory)\vsce
+      artifactName: vsce
 
   steps:
   - checkout: self
@@ -48,9 +52,9 @@ jobs:
       script: |
         export SRC_DIR=$(echo $BUILD_SOURCESDIRECTORY | sed 's|\\|/|g')
         cd "$SRC_DIR/${{ parameters.srcDir }}"
-        npm install
+        npm ci --include=dev --include=optional
         if [ $? -ne 0 ]; then
-          echo "npm install failed, sleeping for 30s before retrying..."
+          echo "npm ci failed, sleeping for 30s before retrying..."
           sleep 30
           exit 1
         fi
@@ -59,9 +63,15 @@ jobs:
   - script: mkdir $(Build.ArtifactStagingDirectory)\vsix
     displayName: Create Staging Directory
 
-  - script: npm install --no-save --ignore-scripts=false --include=optional --force @vscode/vsce@4.0.0
-    displayName: Install vsce
-    workingDirectory: $(Build.SourcesDirectory)\${{ parameters.srcDir }}
+  - task: CopyFiles@2
+    displayName: Stage locked VSCE dependencies for publishing
+    inputs:
+      SourceFolder: $(Build.SourcesDirectory)\${{ parameters.srcDir }}
+      Contents: |
+        package.json
+        package-lock.json
+        .npmrc
+      TargetFolder: $(Build.ArtifactStagingDirectory)\vsce
 
   - script: npm rebuild @vscode/vsce-sign --ignore-scripts=false
     displayName: Rebuild vsce-sign binary
@@ -93,3 +103,7 @@ jobs:
     inputs:
       solution: $(Build.SourcesDirectory)\Build\signing\SignVsix.proj
       msbuildArguments: /p:SignType=${{ parameters.signType }}
+
+  - script: npx vsce verify-signature -i $(Build.ArtifactStagingDirectory)\vsix\${{ parameters.vsixName }}.vsix -m $(Build.ArtifactStagingDirectory)\vsix\${{ parameters.vsixName }}.manifest -s $(Build.ArtifactStagingDirectory)\vsix\${{ parameters.vsixName }}.signature.p7s
+    displayName: Verify VSIX signature
+    workingDirectory: $(Build.SourcesDirectory)\${{ parameters.srcDir }}

Build/publish/jobs_publish_vsix.yml

@@ -14,13 +14,20 @@ jobs:
       pipeline: vsixBuild
       artifactName: vsix
       targetPath: $(Build.StagingDirectory)\vsix
+    - input: pipelineArtifact
+      pipeline: vsixBuild
+      artifactName: vsce
+      targetPath: $(Build.StagingDirectory)\vsce
 
   steps:
   - task: NodeTool@0
     displayName: Use Node 22.x
     inputs:
       versionSpec: 22.x
 
+  - script: IF EXIST %SYSTEMDRIVE%\Users\%USERNAME%\.npmrc del %SYSTEMDRIVE%\Users\%USERNAME%\.npmrc
+    displayName: Delete .npmrc if it exists
+
   - task: AzureCLI@2
     displayName: Generate AAD_TOKEN
     inputs:
@@ -31,16 +38,24 @@ jobs:
         $aadToken = az account get-access-token --query accessToken --resource $(AzureGuid) -o tsv
         Write-Host "##vso[task.setvariable variable=AAD_TOKEN;issecret=true]$aadToken"
 
-  - script: npm install --no-save --ignore-scripts=false --include=optional --force @vscode/vsce@4.0.0
-    displayName: Install vsce
+  - script: npm ci --include=dev --include=optional
+    displayName: Install dependencies
+    workingDirectory: $(Build.StagingDirectory)\vsce
 
   - script: npm rebuild @vscode/vsce-sign --ignore-scripts=false
     displayName: Rebuild vsce-sign binary
+    workingDirectory: $(Build.StagingDirectory)\vsce
 
   - script: if not exist node_modules\@vscode\vsce-sign\bin\vsce-sign.exe (echo Missing vsce-sign.exe && exit 1)
     displayName: Verify vsce-sign binary exists
+    workingDirectory: $(Build.StagingDirectory)\vsce
+
+  - script: npx vsce verify-signature -i $(Build.StagingDirectory)\vsix\${{ parameters.vsixName }}.vsix -m $(Build.StagingDirectory)\vsix\${{ parameters.vsixName }}.manifest -s $(Build.StagingDirectory)\vsix\${{ parameters.vsixName }}.signature.p7s
+    displayName: Verify VSIX signature
+    workingDirectory: $(Build.StagingDirectory)\vsce
 
   - script: npx vsce publish --skip-duplicate -i $(Build.StagingDirectory)\vsix\${{ parameters.vsixName }}.vsix --manifestPath $(Build.StagingDirectory)\vsix\${{ parameters.vsixName }}.manifest --signaturePath $(Build.StagingDirectory)\vsix\${{ parameters.vsixName }}.signature.p7s
     displayName: Publish to Marketplace
+    workingDirectory: $(Build.StagingDirectory)\vsce
     env:
       VSCE_PAT: $(AAD_TOKEN)