Use approved npm feed for Dependabot

[Eduardo Villalpando Mello (edvilme)]

Summary - configure Dependabot npm updates to use the team-owned Pylance_PublicPackages Azure Artifacts feed - authenticate with Azure OIDC using the identity pattern established by microsoft/pyrx#9310 - retain the seven-day npm cooldown because @vscode/python-environments still uses an explicit feed URL that replaces-base cannot redirect - retain the seven-day pip cooldown until an approved Python-feed path is confirmed - remove the project .npmrc that forced Dependabot back to public npm ## Required infrastructure Do not remove no-merge until the managed identity has feed access and a Dependabot federated credential for this repository. The credential must use issuer https://token.actions.msft.ghe.com, audience api://AzureADTokenExchange, and the exact repository subject emitted by Dependabot. The tenant and client IDs are identifiers, not secrets.

[Bill Schnurr (bschnurr)]

🔒 Automated review in progress — Bill Schnurr (@bschnurr) is auto-reviewing this PR.

[Bill Schnurr (bschnurr)]

Result: ⚠️ partially-verified

Verification details

Verification: Isolated verification observed failures that were not classified as caused by this PR: Batched dependency and test discovery.

Summary: The changed Dependabot YAML parsed and passed the repository's Prettier check. Ad-hoc assertions confirmed the approved registry settings, removal of the npm cooldown and `.npmrc`, and retention of the pip cooldown. Dependency setup completed successfully, but the initial discovery probe was limited by unavailable `HEAD^` history. Actual Dependabot OIDC authentication and feed access require external infrastructure and were not exercised, so verification is partial.

Test runs: 3 passed, 1 failed

• ❌ Failed | unrelated to this PR | Batched dependency and test discovery | printf '%s\n' '== sandbox ==' "${AUTOMATION_SANDBOX_PROFILE:-unset}" '== changed files ==' && git diff --name-status HEAD^ HEAD && printf '%s\n' '== dependency state ==' && if [ -d node_modules ]; then echo 'node_modules=present'; else echo 'node_modules=missing'; fi && node --version && npm --version && printf '%s\n' '== relevant scripts/tests ==' && node -e "const p=require('./package.json'); console.log(JSON.stringify(p.scripts,null,2))" && find . -path './node_modules' -prune -o -type f ( -iname 'dependabottest*' -o -iname 'dependabotspec*' ) -print
• ✅ Passed | Prettier check for Dependabot configuration | node ./node_modules/prettier/bin/prettier.cjs --check .github/dependabot.yml
• ✅ Passed | Offline dependency bootstrap | npm ci --offline --ignore-scripts
• ✅ Passed | Dependabot feed configuration assertions | node - <<'NODE'
const fs = require('fs');
const path = '.github/dependabot.yml';
const text = fs.readFileSync(path, 'utf8');
const required = [
'pylance-public-packages:',
'type: npm-registry',
'url: https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/Pylance_PublicPackages/npm/registry/',
'tenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47',
'client-id: 92c669e8-02ad-4ce6-ad73-f222fc7177e2',
'replaces-base: true',
"registries: ''",
];
for (const value of required) {
if (!text.includes(value)) throw new Error(missing expected configuration: ${value});
}
if (fs.existsSync('.npmrc')) throw new Error('.npmrc still exists');
const npmBlock = text.match(/ - package-ecosystem: 'npm'([\s\S]?)(?=\n - package-ecosystem:)/)?.[1];
const pipBlock = text.match(/ - package-ecosystem: 'pip'([\s\S]?)(?=\n - package-ecosystem:)/)?.[1];
if (!npmBlock || npmBlock.includes('cooldown:')) throw new Error('npm cooldown was not removed');
if (!pipBlock || !/cooldown:\s\n\s*default-days: 7/.test(pipBlock)) throw new Error('pip seven-day cooldown was not retained');
console.log('Dependabot feed configuration assertions passed.');
NODE

❌ Batched dependency and test discovery diagnostic output

== sandbox ==
typescript
== changed files ==
error: Could not access 'HEAD^'

[Bill Schnurr (bschnurr)]

Approved via Review Center.

[Bill Schnurr (bschnurr)]

Result: ⚠️ partially-verified

Verification details

Verification: Isolated verification observed failures that were not classified as caused by this PR: Ruby YAML structural validation.

Summary: The targeted Prettier check passed, confirming `.github/dependabot.yml` is valid YAML and formatted correctly. Static assertions also confirmed the approved feed settings, npm association, cooldowns, and `.npmrc` removal. A Ruby-based parser check could not run because Ruby is unavailable, and the hosted Dependabot OIDC/feed authentication flow cannot be exercised in this environment. Verification is therefore partial.

Test runs: 4 passed, 1 failed

• ❌ Failed | unrelated to this PR | Ruby YAML structural validation | ruby -e 'require "yaml"; c=YAML.load_file(".github/dependabot.yml"); r=c.fetch("registries").fetch("pylance-public-packages"); raise "registry type" unless r["type"]=="npm-registry"; raise "registry URL" unless r["url"]=="https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/Pylance_PublicPackages/npm/registry/"; raise "tenant ID" unless r["tenant-id"]=="72f988bf-86f1-41af-91ab-2d7cd011db47"; raise "client ID" unless r["client-id"]=="92c669e8-02ad-4ce6-ad73-f222fc7177e2"; raise "replaces-base" unless r["replaces-base"]==true; npm=c.fetch("updates").find{|u| u["package-ecosystem"]=="npm"}; pip=c.fetch("updates").find{|u| u["package-ecosystem"]=="pip"}; raise "npm registry association" unless npm["registries"]==["pylance-public-packages"]; raise "npm cooldown" unless npm.dig("cooldown","default-days")==7; raise "pip cooldown" unless pip.dig("cooldown","default-days")==7; raise ".npmrc still exists" if File.exist?(".npmrc"); puts "Dependabot registry, update association, cooldowns, and .npmrc removal verified"'
• ✅ Passed | Prettier check for Dependabot configuration | node ./node_modules/prettier/bin/prettier.cjs --check .github/dependabot.yml
• ✅ Passed | Dependency and test discovery | printf 'Changed files:\n'; git diff --name-status HEAD^ -- .; printf '\nSandbox profile: %s\n' "${AUTOMATION_SANDBOX_PROFILE:-unset}"; printf 'Root node_modules: '; test -d node_modules && echo present || echo missing; printf 'Shared node_modules: '; test -d external/vscode-common-python-lsp/typescript/node_modules && echo present || echo missing; printf '\nRelevant scripts:\n'; node -e "const p=require('./package.json'); console.log(JSON.stringify({formatCheck:p.scripts['format-check']},null,2))"; printf '\nCandidate config tests:\n'; find . -type f ( -iname 'dependabottest*' -o -iname 'npmrctest*' ) -print
• ✅ Passed | Offline Node dependency bootstrap | npm ci --offline --ignore-scripts
• ✅ Passed | Dependabot feed and cooldown static assertions | node -e 'const fs=require("fs"),assert=require("assert"); const s=fs.readFileSync(".github/dependabot.yml","utf8"); assert(!fs.existsSync(".npmrc"),".npmrc still exists"); for (const text of ["type: npm-registry","url: https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/Pylance_PublicPackages/npm/registry/","tenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47","client-id: 92c669e8-02ad-4ce6-ad73-f222fc7177e2","replaces-base: true"," - 'pylance-public-packages'"]) assert(s.includes(text),missing ${text}); const npm=s.match(/- package-ecosystem: 'npm'[\s\S]?(?=\n - package-ecosystem:)/)?.[0]; const pip=s.match(/- package-ecosystem: 'pip'[\s\S]?(?=\n - package-ecosystem:)/)?.[0]; assert(npm?.includes("registries:") && npm.includes("default-days: 7"),"npm registry/cooldown missing"); assert(pip?.includes("default-days: 7"),"pip cooldown missing"); console.log("Dependabot feed fields, npm association, cooldowns, and .npmrc removal verified")'

❌ Ruby YAML structural validation diagnostic output

/bin/sh: 1: ruby: not found