Move pip authentication to run immediately after checkout in all pipeline jobs (#45223)

* Move pip authentication to run immediately after checkout in all pipeline jobs

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: scbedd <45376673+scbedd@users.noreply.github.com>

Author: Copilot

eng/pipelines/templates/jobs/ci.tests.yml

@@ -96,6 +96,10 @@ jobs:
         Paths:
           - '**'
 
+    # Authenticate to Azure Artifacts feed immediately after checkout to prevent 401 errors
+    # Public feeds have upstream sources enabled and require authentication for passthrough to pypi.org
+    - template: /eng/pipelines/templates/steps/auth-dev-feed.yml
+
     - template: /eng/pipelines/templates/steps/download-package-artifacts.yml
 
     - template: /eng/pipelines/templates/steps/resolve-package-targeting.yml

eng/pipelines/templates/jobs/regression.yml

@@ -71,6 +71,12 @@ jobs:
 
     # Please use `$(TargetingString)` to refer to the python packages glob string. This was previously `${{ parameters.BuildTargetingString }}`.
     steps:
+      # Authenticate to Azure Artifacts feed immediately after checkout to prevent 401 errors
+      # Public feeds have upstream sources enabled and require authentication for passthrough to pypi.org
+      - template: ../steps/auth-dev-feed.yml
+        parameters:
+          DevFeedName: ${{ parameters.DevFeedName }}
+
       - template: /eng/pipelines/templates/steps/resolve-package-targeting.yml
         parameters:
           BuildTargetingString: ${{ parameters.BuildTargetingString }}
@@ -97,11 +103,6 @@ jobs:
         parameters:
           ServiceDirectory: ${{ parameters.ServiceDirectory }}
 
-      - ${{if eq(variables['System.TeamProject'], 'internal') }}:
-        - template: ../steps/auth-dev-feed.yml
-          parameters:
-            DevFeedName: ${{ parameters.DevFeedName }}
-
       - task: PythonScript@0
         displayName: 'Test Latest Released Dependents'
         inputs:

eng/pipelines/templates/steps/analyze.yml

@@ -10,6 +10,12 @@ parameters:
 
 # Please use `$(TargetingString)` to refer to the python packages glob string. This variable is set from resolve-package-targeting.yml.
 steps:
+  # Authenticate to Azure Artifacts feed immediately to prevent 401 errors
+  # Public feeds have upstream sources enabled and require authentication for passthrough to pypi.org
+  - template: ../steps/auth-dev-feed.yml
+    parameters:
+      DevFeedName: ${{ parameters.DevFeedName }}
+
   - template: /eng/pipelines/templates/steps/analyze_dependency.yml
     parameters:
       ScanPath: $(Build.SourcesDirectory)/sdk/${{ parameters.ServiceDirectory }}
@@ -20,11 +26,6 @@ steps:
       ServiceDirectory: "template"
       TestPipeline: ${{ parameters.TestPipeline }}
 
-  - ${{if eq(variables['System.TeamProject'], 'internal') }}:
-    - template: ../steps/auth-dev-feed.yml
-      parameters:
-        DevFeedName: ${{ parameters.DevFeedName }}
-
   - task: PythonScript@0
     displayName: 'Set Checks Environment Skips'
     condition: succeededOrFailed()

eng/pipelines/templates/steps/auth-dev-feed.yml

@@ -25,10 +25,17 @@ steps:
       artifactFeeds: $(DevFeedName)
       onlyAddExtraIndex: false
 
-  # disabled until completion of python part of azure/azure-sdk-tools#9101
-  # - pwsh: |
-  #     if ($env:PIP_INDEX_URL) {
-  #       Write-Host "PIP Index URL detected: $env:PIP_INDEX_URL"
-  #       Write-Host "##vso[task.setvariable variable=UV_DEFAULT_INDEX]$($env:PIP_INDEX_URL)"
-  #     }
-  #   displayName: 'Mirror PIP Index URL to UV Index URL'
+  # Disabled UV authentication step - for future enablement when UV fully supports Azure Artifacts
+  # To enable: uncomment this step and ensure UV_INDEX_URL is properly configured
+  # The PipAuthenticate task above creates a .pypirc file in the home directory that UV can use
+  - pwsh: |
+      # This step configures UV to use the same authentication as pip
+      # UV will read credentials from ~/.pypirc created by PipAuthenticate task
+      if ($env:PIP_INDEX_URL) {
+        Write-Host "PIP Index URL detected: $env:PIP_INDEX_URL"
+        # Uncomment the next line to enable UV authentication
+        # Write-Host "##vso[task.setvariable variable=UV_INDEX_URL]$($env:PIP_INDEX_URL)"
+        Write-Host "UV authentication is currently disabled. To enable, uncomment the variable assignment above."
+      }
+    displayName: 'Configure UV Authentication (Disabled)'
+    condition: false  # Explicitly disabled - change to 'true' or remove to enable

eng/pipelines/templates/steps/build-extended-artifacts.yml

@@ -23,6 +23,12 @@ parameters:
 
 # Please use `$(TargetingString)` to refer to the python packages glob string. This variable is set from resolve-package-targeting.yml.
 steps:
+  # Authenticate to Azure Artifacts feed immediately after checkout to prevent 401 errors
+  # Public feeds have upstream sources enabled and require authentication for passthrough to pypi.org
+  - template: auth-dev-feed.yml
+    parameters:
+      DevFeedName: ${{ parameters.DevFeedName }}
+
   - task: UsePythonVersion@0
     displayName: 'Use Python 3.13'
     inputs:
@@ -37,11 +43,6 @@ steps:
       }
     displayName: Set Component Governance Path
 
-  - ${{if eq(variables['System.TeamProject'], 'internal') }}:
-    - template: auth-dev-feed.yml
-      parameters:
-        DevFeedName: ${{ parameters.DevFeedName }}
-
   - template: /eng/common/pipelines/templates/steps/set-test-pipeline-version.yml
     parameters:
       PackageName: "azure-template"

eng/pipelines/templates/steps/build-package-artifacts.yml

@@ -32,6 +32,12 @@ steps:
       Paths:
         - '**'
 
+  # Authenticate to Azure Artifacts feed immediately after checkout to prevent 401 errors
+  # Public feeds have upstream sources enabled and require authentication for passthrough to pypi.org
+  - template: auth-dev-feed.yml
+    parameters:
+      DevFeedName: ${{ parameters.DevFeedName }}
+
   - task: UsePythonVersion@0
     displayName: 'Use Python $(PythonVersion)'
     condition: and(succeeded(), or(eq(variables['ENABLE_EXTENSION_BUILD'], 'true'), eq('${{ parameters.ArtifactSuffix }}', 'linux')))
@@ -48,11 +54,6 @@ steps:
 
   - template: /eng/common/pipelines/templates/steps/set-default-branch.yml@self
 
-  - ${{if eq(variables['System.TeamProject'], 'internal') }}:
-    - template: auth-dev-feed.yml
-      parameters:
-        DevFeedName: ${{ parameters.DevFeedName }}
-
   - script: |
       echo "##vso[build.addbuildtag]Scheduled"
     displayName: 'Tag scheduled builds'

eng/pipelines/templates/steps/build-test.yml

@@ -36,11 +36,6 @@ steps:
 
   - template: set-dev-build.yml
 
-  - ${{if eq(variables['System.TeamProject'], 'internal') }}:
-    - template: ../steps/auth-dev-feed.yml
-      parameters:
-        DevFeedName: ${{ parameters.DevFeedName }}
-
   - pwsh: |
       Write-Host (Get-Command python).Source
       $ErrorActionPreference = 'Stop'