Always set PIP_INDEX_URL

Author: dkurepa

eng/pipelines/stages/dotnet-buildtools-prereqs.yml

@@ -23,18 +23,19 @@ stages:
         name: NetCore1ESPool-Internal-XL
         image: build.ubuntu.2204.amd64
         os: linux
-      ${{ if eq(variables['System.TeamProject'], 'internal') }}:
-        customCopyBaseImagesInitSteps:
+      customBuildInitSteps:
+      - template: /eng/pipelines/steps/pip-authenticate.yml@self
+      - ${{ if eq(variables['System.TeamProject'], 'internal') }}:
         - template: /eng/pipelines/steps/set-base-image-override-options.yml@self
           parameters:
-            variableName: customCopyBaseImagesArgs
+            variableName: imageBuilderBuildArgs
             dockerfileOs: (centos|debian)
             baseOverrideRegistry: $(overrideRegistry) # Comes from DotNet-Docker-Common variable group
-        customBuildInitSteps:
-        - template: /eng/pipelines/steps/pip-authenticate.yml@self
+      ${{ if eq(variables['System.TeamProject'], 'internal') }}:
+        customCopyBaseImagesInitSteps:
         - template: /eng/pipelines/steps/set-base-image-override-options.yml@self
           parameters:
-            variableName: imageBuilderBuildArgs
+            variableName: customCopyBaseImagesArgs
             dockerfileOs: (centos|debian)
             baseOverrideRegistry: $(overrideRegistry) # Comes from DotNet-Docker-Common variable group
       # Force all images to be rebuilt when triggered by the schedule

eng/pipelines/steps/pip-authenticate.yml

@@ -1,16 +1,29 @@
 steps:
-- task: PipAuthenticate@1
-  displayName: 'Pip Authenticate'
-  inputs:
-    # Authenticates the dotnet-public-pypi feed (a full pypi mirror) and sets
-    # PIP_INDEX_URL to the authenticated URL. Dockerfiles that install Helix
-    # wheels override the index per-command to point at helix-client-prod and
-    # use this value as --extra-index-url so transitive deps fall back to the
-    # full mirror when the curated Helix feed lacks a matching wheel.
-    artifactFeeds: public/dotnet-public-pypi,public/helix-client-prod
-    onlyAddExtraIndex: false
-- powershell: |
-    $options = "$(imageBuilderBuildArgs)"
-    $options += " --build-arg PIP_INDEX_URL=$env:PIP_INDEX_URL --build-arg NPM_TOKEN=$(System.AccessToken)"
-    echo "##vso[task.setvariable variable=imageBuilderBuildArgs]$options"
-  displayName: Set PIP and NPM Build Args
+# Provide PIP_INDEX_URL (and, internally, NPM_TOKEN) as image build args.
+# Dockerfiles that install Helix wheels override the index per-command to point
+# at helix-client-prod and use PIP_INDEX_URL as --extra-index-url so transitive
+# deps fall back to the full dotnet-public-pypi mirror when the curated Helix
+# feed lacks a matching wheel.
+#
+# Both feeds live in the dnceng org's public project. Internally we authenticate
+# them (so the pypi mirror can pull packages through from upstream and to avoid
+# anonymous throttling). In the public project those feeds are in a different
+# org and a fork-PR token can't authenticate them, but they are anonymously
+# readable, so we point PIP_INDEX_URL straight at the mirror with no token.
+- ${{ if eq(variables['System.TeamProject'], 'internal') }}:
+  - task: PipAuthenticate@1
+    displayName: 'Pip Authenticate'
+    inputs:
+      artifactFeeds: public/dotnet-public-pypi,public/helix-client-prod
+      onlyAddExtraIndex: false
+  - powershell: |
+      $options = "$(imageBuilderBuildArgs)"
+      $options += " --build-arg PIP_INDEX_URL=$env:PIP_INDEX_URL --build-arg NPM_TOKEN=$(System.AccessToken)"
+      echo "##vso[task.setvariable variable=imageBuilderBuildArgs]$options"
+    displayName: Set PIP and NPM Build Args
+- ${{ else }}:
+  - powershell: |
+      $options = "$(imageBuilderBuildArgs)"
+      $options += " --build-arg PIP_INDEX_URL=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-pypi/pypi/simple/"
+      echo "##vso[task.setvariable variable=imageBuilderBuildArgs]$options"
+    displayName: Set Public PIP Build Arg