From c8e125da46dca73ce60a7ce9d68718ba617b5083 Mon Sep 17 00:00:00 2001
From: Bharat Middha <5100938+bmiddha@users.noreply.github.com>
Date: Tue, 8 Sep 2026 13:04:46 -0700
Subject: [PATCH 1/2] Configure npm feed proxy

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 common/config/rush/.npmrc         | 10 ++--------
 common/config/rush/.npmrc-publish | 12 +++---------
 2 files changed, 5 insertions(+), 17 deletions(-)

diff --git a/common/config/rush/.npmrc b/common/config/rush/.npmrc
index 43f783886..0f9409930 100644
--- a/common/config/rush/.npmrc
+++ b/common/config/rush/.npmrc
@@ -18,16 +18,10 @@
 # It is NOT recommended to store authentication tokens in a text file on a lab machine, because
 # other unrelated processes may be able to read that file.  Also, the file may persist indefinitely,
 # for example if the machine loses power.  A safer practice is to pass the token via an
-# environment variable, which can be referenced from .npmrc using ${} expansion.  For example:
-#
-#   //registry.npmjs.org/:_authToken=${NPM_AUTH_TOKEN}
-#
+# environment variable, which can be referenced from .npmrc using ${} expansion.
 
 # Explicitly specify the NPM registry that "rush install" and "rush update" will use by default:
-registry=https://registry.npmjs.org/
-
-# Optionally provide an authentication token for the above registry URL (if it is a private registry):
-# //registry.npmjs.org/:_authToken=${NPM_AUTH_TOKEN}
+registry=https://packagefeedproxy.microsoft.io/npm/
 
 # Change this to "true" if your registry requires authentication for read-only operations:
 always-auth=false
diff --git a/common/config/rush/.npmrc-publish b/common/config/rush/.npmrc-publish
index 51acb920e..b87f054da 100644
--- a/common/config/rush/.npmrc-publish
+++ b/common/config/rush/.npmrc-publish
@@ -14,13 +14,7 @@
 # It is NOT recommended to store authentication tokens in a text file on a lab machine, because
 # other unrelated processes may be able to read the file.  Also, the file may persist indefinitely,
 # for example if the machine loses power.  A safer practice is to pass the token via an
-# environment variable, which can be referenced from .npmrc using ${} expansion.  For example:
-#
-#   //registry.npmjs.org/:_authToken=${NPM_AUTH_TOKEN}
-#
-
-# Explicitly specify the NPM registry that "rush publish" will use by default:
-registry=https://registry.npmjs.org/
+# environment variable, which can be referenced from .npmrc using ${} expansion.
 
-# Provide an authentication token for the above registry URL:
-# //registry.npmjs.org/:_authToken=${NPM_AUTH_TOKEN}
+always-auth=true
+registry=https://packagefeedproxy.microsoft.io/npm/

From bd821b39cd5d57ce53e570f0ad0a5754425ccb8a Mon Sep 17 00:00:00 2001
From: Bharat Middha <5100938+bmiddha@users.noreply.github.com>
Date: Tue, 8 Sep 2026 13:09:07 -0700
Subject: [PATCH 2/2] Keep npm lockfile registry neutral

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 common/config/rush/.npmrc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/common/config/rush/.npmrc b/common/config/rush/.npmrc
index 0f9409930..7232367b4 100644
--- a/common/config/rush/.npmrc
+++ b/common/config/rush/.npmrc
@@ -22,6 +22,7 @@
 
 # Explicitly specify the NPM registry that "rush install" and "rush update" will use by default:
 registry=https://packagefeedproxy.microsoft.io/npm/
+omit-lockfile-registry-resolved=true
 
 # Change this to "true" if your registry requires authentication for read-only operations:
 always-auth=false