Route package installs through Microsoft feed proxies

.eslintrc.json

@@ -16,6 +16,14 @@
         "no-throw-literal": "warn",
         "semi": "off"
     },
+    "overrides": [
+        {
+            "files": ["build/setup*.js", "build/normalize-package-lock*.js"],
+            "env": { "node": true, "es2022": true },
+            "parserOptions": { "ecmaVersion": 2022, "sourceType": "script" },
+            "rules": { "@typescript-eslint/naming-convention": "off" }
+        }
+    ],
     "ignorePatterns": [
         "out",
         "dist",

.githooks/.gitattributes

@@ -0,0 +1 @@
+pre-commit text eol=lf

.githooks/pre-commit

@@ -0,0 +1,5 @@
+#!/bin/sh
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+exec node build/normalize-package-lock.js --staged

.github/actions/build-vsix/action.yml

@@ -35,8 +35,10 @@ runs:
       run: python -m pip install -U pip pipx wheel
       shell: bash
 
-    - name: Run npm ci
-      run: npm ci --prefer-offline
+    - name: Install Node dependencies through Microsoft feeds
+      run: npm run ci:msft
+      env:
+        npm_config_prefer_offline: 'true'
       shell: bash
 
     - name: Install bundled python libraries

.github/actions/lint/action.yml

@@ -15,8 +15,12 @@ runs:
         node-version: ${{ inputs.node_version }}
         cache: 'npm'
 
+    - name: Test setup and hook scripts (no dependencies required)
+      run: npm run test:setup
+      shell: bash
+
     - name: Install Node dependencies
-      run: npm ci
+      run: npm run ci:msft
       shell: bash
 
     - name: Lint TypeScript code

.github/workflows/codeql-analysis.yml

@@ -20,6 +20,10 @@ on:
   schedule:
     - cron: '15 16 * * 2'
 
+env:
+  NPM_CONFIG_REGISTRY: https://packagefeedproxy.microsoft.io/npm/
+  PIP_INDEX_URL: https://packagefeedproxy.microsoft.io/pypi/simple/
+
 jobs:
   analyze:
     name: Analyze

.github/workflows/pr-check.yml

@@ -6,6 +6,7 @@ on:
 permissions: {}
 
 env:
+  PIP_INDEX_URL: https://packagefeedproxy.microsoft.io/pypi/simple/
   NODE_VERSION: 22.17.0
   TEST_RESULTS_DIRECTORY: .
   # Force a path with spaces and unicode chars to test extension works in these scenarios
@@ -84,7 +85,7 @@ jobs:
           cache-dependency-path: ${{ env.special-working-directory-relative }}/package-lock.json
 
       - name: Install dependencies (npm ci)
-        run: npm ci
+        run: npm run ci:msft
 
       # Now that the bundle is installed to target using python 3.9
       # switch back the python we want to test with

.github/workflows/push-check.yml

@@ -11,6 +11,7 @@ on:
 permissions: {}
 
 env:
+  PIP_INDEX_URL: https://packagefeedproxy.microsoft.io/pypi/simple/
   NODE_VERSION: 22.17.0
   TEST_RESULTS_DIRECTORY: .
   # Force a path with spaces and unicode chars to test extension works in these scenarios
@@ -89,7 +90,7 @@ jobs:
           cache-dependency-path: ${{ env.special-working-directory-relative }}/package-lock.json
 
       - name: Install dependencies (npm ci)
-        run: npm ci
+        run: npm run ci:msft
 
       # Now that the bundle is installed to target using python 3.9
       # switch back the python we want to test with

README.md

@@ -54,3 +54,81 @@ You can reference the table below to find the most recent Python Debugger extens
 
 ## Data and telemetry
 The Debugpy Extension for Visual Studio Code collects usage data and sends it to Microsoft to help improve our products and services. Read our [privacy statement](https://privacy.microsoft.com/privacystatement) to learn more. This extension respects the `telemetry.telemetryLevel` setting which you can learn more about at https://code.visualstudio.com/docs/supporting/faq#_how-to-disable-telemetry-reporting.
+
+### Local package feeds
+
+Use Node.js supported by this repository and Python 3.10 or later. Both setup commands create or reuse `.venv` and install the Python bundling tools. Choose the appropriate setup below before installing dependencies. Committed lockfiles use public npm URLs; Microsoft setup rewrites working copies for proxy installs.
+
+#### Public contributors (non-Microsoft employees)
+
+Use the public setup, which selects `https://registry.npmjs.org/` and `https://pypi.org/simple/` for its child processes. No Microsoft account or internal-feed credentials are needed, and this command works before `node_modules` exists:
+
+From the repository root:
+
+```bash
+npm run setup
+```
+
+For subsequent npm installs, use `npm ci`. Public contributors do not need the Microsoft feed commands or lockfile hook.
+
+#### Microsoft employees only
+
+> **Microsoft users only:** The commands in this section configure Microsoft package feeds. Public contributors should use the public setup above.
+
+Use the Microsoft setup, which selects `https://packagefeedproxy.microsoft.io/npm/` and `https://packagefeedproxy.microsoft.io/pypi/simple/` for its child processes:
+
+```bash
+npm run setup:msft
+```
+
+Microsoft setup rewrites public npm and Yarn `resolved` URLs in the root `package-lock.json` to the npm proxy before running `npm ci`. Versions, integrity hashes, formatting, and private-feed URLs are preserved. The public setup leaves lockfiles unchanged.
+
+After pulling a new lockfile from GitHub, rerun `npm run setup:msft`, or run the dependency-free rewrite step alone before your next install/build:
+
+```bash
+npm run setup:msft-registry
+```
+
+The standalone step requires the root lockfile to exist; it does not require a shared TypeScript checkout. Rewriting is idempotent and stops on missing or invalid lockfiles. Keep committed lockfile URLs public using the optional pre-commit hook below (or `npm run normalize-lockfile` for the root lockfile).
+
+For subsequent root npm installs, use:
+
+```bash
+npm run ci:msft
+```
+
+This rewrites the root lockfile, then runs root `npm ci` with the proxy registry explicitly selected for package, audit, and metadata requests. Use `npm run setup:msft` for full setup, including Python dependencies.
+
+Local setup, lockfile rewriting, and `ci:msft` share the feed URLs in `build/package-feeds.json`.
+
+Both setup commands use the same implementation, stop on errors, and keep registry overrides scoped to setup's child processes; they do not change your shell environment, edit `.npmrc`, or add credentials. The standalone rewrite step only edits lockfiles; it does not configure the registry for subsequent commands.
+
+After setup, run `npm run compile` to build the extension. For subsequent Python commands, use `.venv\Scripts\python.exe` on Windows or `.venv/bin/python` on macOS/Linux (or activate that virtual environment). Registry overrides are not retained after setup.
+
+#### Microsoft contributor pre-commit hook
+
+If you use the Microsoft feeds and will commit changes, enable the recommended lockfile hook once per clone (no installed npm dependencies are required). It is not needed just to install or build:
+
+```bash
+npm run setup-hooks
+```
+
+The installer sets the clone's local `core.hooksPath` to `.githooks`, which also affects its linked worktrees. It refuses to replace an existing hook or a different hooks configuration. If you already use hooks, add `node build/normalize-package-lock.js --staged` to your existing pre-commit hook instead. Only enable this configuration in worktrees/branches that contain these hook files.
+
+Before a local commit, the hook converts known `Pylance_PublicPackages`, `packagefeedproxy.microsoft.io/npm/`, and named `1es-public/npm-public` mirror tarball URLs in the staged root `package-lock.json` to public npm URLs. It preserves versions, integrity hashes, formatting, and intentional Azure-hosted dependencies such as `msft_consumption`. Unknown feeds are left unchanged. It re-stages only the lockfile; if normalization is needed and the lockfile has unstaged changes, the commit is blocked without modifying it. Stage or stash those changes, then retry.
+
+To normalize manually, run `npm run normalize-lockfile`, review the changes, and stage them. To disable the installed hook, run `git config --local --unset core.hooksPath`. These are local Git hooks: GitHub and Dependabot do not execute them. No workflow writes changes to PR branches.
+
+### GitHub Actions package feeds
+
+The PR and push workflows set `PIP_INDEX_URL` to `https://packagefeedproxy.microsoft.io/pypi/simple/` for pip and nox installs. Their Node installation steps select `https://packagefeedproxy.microsoft.io/npm/` explicitly through `npm run ci:msft`, so these workflows do not set `NPM_CONFIG_REGISTRY`. CodeQL retains both environment variables because its autobuild step does not use the install helper. The npm endpoint follows the [TypeScript CI package-feed-proxy job](https://github.com/microsoft/TypeScript/blob/main/.github/workflows/ci.yml).
+
+The shared lint and VSIX build actions and applicable PR/push test jobs use `npm run ci:msft`, rewriting working-copy lockfile URLs before installation and explicitly selecting the proxy for npm requests. Workflows do not commit these rewrites or change local registry configuration or Dependabot configuration. Existing dependency caches are retained; the VSIX build also retains its offline-cache preference. CodeQL retains workflow-level feed settings for its autobuild step.
+
+### Azure release package feeds
+
+The DevDiv Azure stable/prerelease pipelines pass the npm proxy to their build/publish templates using `customNPMRegistry`. Their dependency install steps use `npm run ci:msft` to rewrite the root npm lockfile and install through the proxy.
+
+Each Python bootstrap and bundled-library install step explicitly sets `PIP_INDEX_URL` from `PIP_PROXY_INDEX_URL`, selecting the pip proxy even when a template's authentication setup changes the job-level index. Release triggers, approval gates, signing, and publishing behavior are unchanged.
+
+Dependabot continues to use public registries and its existing update settings. Legacy Azure stable, prerelease, and validation definitions are unchanged.

build/azure-devdiv-pipeline.pre-release.yml

@@ -26,8 +26,10 @@ variables:
     value: VSCode-python-debugger
   - name: VsixName
     value: python-debugger.vsix
-  - name: AZURE_ARTIFACTS_FEED
-    value: 'https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/Pylance_PublicPackages/npm/registry/'
+  - name: NPM_CONFIG_REGISTRY
+    value: 'https://packagefeedproxy.microsoft.io/npm/'
+  - name: PIP_PROXY_INDEX_URL
+    value: 'https://packagefeedproxy.microsoft.io/pypi/simple/'
 
 parameters:
   - name: publishExtension
@@ -65,20 +67,28 @@ parameters:
   - name: buildSteps
     type: stepList
     default:
-      - script: npm ci
+      - script: npm run ci:msft
         displayName: Install NPM dependencies
 
       - script: python -m pip install -U pip
         displayName: Upgrade pip
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python -m pip install wheel
         displayName: Install wheel
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python -m pip install nox
         displayName: Install nox
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python -m nox --session install_bundled_libs
         displayName: Install Python dependencies
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python ./build/update_ext_version.py --for-publishing
         displayName: Update build number
@@ -114,7 +124,7 @@ extends:
               buildSteps: ${{ parameters.buildSteps }}
               isPreRelease: true
               standardizedVersioning: true
-              customNPMRegistry: $(AZURE_ARTIFACTS_FEED)
+              customNPMRegistry: $(NPM_CONFIG_REGISTRY)
 
       - stage: Publish
         displayName: Publish Extension
@@ -129,4 +139,4 @@ extends:
               ghCreateTag: true
               ghCreateRelease: true
               ghReleaseAddChangeLog: true
-              customNPMRegistry: $(AZURE_ARTIFACTS_FEED)
+              customNPMRegistry: $(NPM_CONFIG_REGISTRY)

build/azure-devdiv-pipeline.stable.yml

@@ -21,8 +21,10 @@ variables:
     value: VSCode-python-debugger
   - name: VsixName
     value: python-debugger.vsix
-  - name: AZURE_ARTIFACTS_FEED
-    value: 'https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/Pylance_PublicPackages/npm/registry/'
+  - name: NPM_CONFIG_REGISTRY
+    value: 'https://packagefeedproxy.microsoft.io/npm/'
+  - name: PIP_PROXY_INDEX_URL
+    value: 'https://packagefeedproxy.microsoft.io/pypi/simple/'
 
 parameters:
   - name: publishExtension
@@ -60,20 +62,28 @@ parameters:
   - name: buildSteps
     type: stepList
     default:
-      - script: npm ci
+      - script: npm run ci:msft
         displayName: Install NPM dependencies
 
       - script: python -m pip install -U pip
         displayName: Upgrade pip
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python -m pip install wheel
         displayName: Install wheel
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python -m pip install nox
         displayName: Install nox
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python -m nox --session install_bundled_libs
         displayName: Install Python dependencies
+        env:
+          PIP_INDEX_URL: $(PIP_PROXY_INDEX_URL)
 
       - script: python ./build/update_ext_version.py --release --for-publishing
         displayName: Update build number
@@ -109,7 +119,7 @@ extends:
               buildSteps: ${{ parameters.buildSteps }}
               isPreRelease: false
               standardizedVersioning: true
-              customNPMRegistry: $(AZURE_ARTIFACTS_FEED)
+              customNPMRegistry: $(NPM_CONFIG_REGISTRY)
 
       - stage: WaitForValidation
         displayName: Wait for Validation
@@ -139,4 +149,4 @@ extends:
               ghCreateTag: true
               ghCreateRelease: true
               ghReleaseAddChangeLog: true
-              customNPMRegistry: $(AZURE_ARTIFACTS_FEED)
+              customNPMRegistry: $(NPM_CONFIG_REGISTRY)