Always use the dotnet-public-npm feed

Author: premun

eng/pipelines/steps/pip-authenticate.yml

@@ -16,11 +16,10 @@ steps:
     # rather than appending a duplicate --build-arg.
     $options = "$(imageBuilderBuildArgs)"
     $options = $options -replace '--build-arg PIP_INDEX_URL=\S+', "--build-arg PIP_INDEX_URL=$env:PIP_INDEX_URL"
-    # Dockerfiles default NPM_REGISTRY to the Microsoft public npm proxy (for public/local
-    # builds). On internal builds, point npm at the authenticated dotnet-public-npm feed and
-    # provide the token so the auth key derived from the URL resolves. Keeping the internal
-    # feed URL here means it lives in exactly one place instead of every Dockerfile.
-    $options += " --build-arg NPM_REGISTRY=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/"
+    # The npm registry (public dotnet-public-npm feed) is baked into the Dockerfiles as the
+    # NPM_REGISTRY default and is read anonymously, so no override is needed here. Internal
+    # builds additionally pass a token so they can ingest new package versions; the token is
+    # optional and unused on anonymous reads.
     $options += " --build-arg NPM_TOKEN=$(System.AccessToken)"
     echo "##vso[task.setvariable variable=imageBuilderBuildArgs]$options"
   displayName: Set PIP and NPM Build Args

src/azurelinux/3.0/net10.0/webassembly/amd64/Dockerfile

@@ -12,9 +12,10 @@ RUN tdnf update -y \
         libxml2 \
         unzip
 
-# Registry npm installs pull from; defaults to the Microsoft public npm proxy.
-# Internal builds override NPM_REGISTRY with the dotnet-public-npm Azure Artifacts feed and set NPM_TOKEN.
-ARG NPM_REGISTRY=https://packagefeedproxy.microsoft.io/npm/
+# npm registry. Defaults to the public dotnet-public-npm Azure Artifacts feed, which is
+# readable anonymously (works for local/dev and public builds). NPM_TOKEN is optional and
+# only needed by internal builds that ingest new package versions into the feed.
+ARG NPM_REGISTRY=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
 ARG NPM_TOKEN
 
 RUN npm config set registry "$NPM_REGISTRY" && \

src/azurelinux/3.0/net8.0/webassembly/amd64/Dockerfile

@@ -13,9 +13,10 @@ RUN tdnf update -y \
         # dependency for npm package modification
         jq
 
-# Registry npm installs pull from; defaults to the Microsoft public npm proxy.
-# Internal builds override NPM_REGISTRY with the dotnet-public-npm Azure Artifacts feed and set NPM_TOKEN.
-ARG NPM_REGISTRY=https://packagefeedproxy.microsoft.io/npm/
+# npm registry. Defaults to the public dotnet-public-npm Azure Artifacts feed, which is
+# readable anonymously (works for local/dev and public builds). NPM_TOKEN is optional and
+# only needed by internal builds that ingest new package versions into the feed.
+ARG NPM_REGISTRY=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
 ARG NPM_TOKEN
 
 RUN npm config set registry "$NPM_REGISTRY" && \

src/azurelinux/3.0/net9.0/webassembly/amd64/Dockerfile

@@ -12,9 +12,10 @@ RUN tdnf update -y \
         libxml2 \
         unzip
 
-# Registry npm installs pull from; defaults to the Microsoft public npm proxy.
-# Internal builds override NPM_REGISTRY with the dotnet-public-npm Azure Artifacts feed and set NPM_TOKEN.
-ARG NPM_REGISTRY=https://packagefeedproxy.microsoft.io/npm/
+# npm registry. Defaults to the public dotnet-public-npm Azure Artifacts feed, which is
+# readable anonymously (works for local/dev and public builds). NPM_TOKEN is optional and
+# only needed by internal builds that ingest new package versions into the feed.
+ARG NPM_REGISTRY=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
 ARG NPM_TOKEN
 
 RUN npm config set registry "$NPM_REGISTRY" && \

src/azurelinux/3.0/renovate/amd64/Dockerfile

@@ -17,9 +17,10 @@ RUN tdnf update -y && \
         util-linux \
     && tdnf clean all
 
-# Registry npm installs pull from; defaults to the Microsoft public npm proxy.
-# Internal builds override NPM_REGISTRY with the dotnet-public-npm Azure Artifacts feed and set NPM_TOKEN.
-ARG NPM_REGISTRY=https://packagefeedproxy.microsoft.io/npm/
+# npm registry. Defaults to the public dotnet-public-npm Azure Artifacts feed, which is
+# readable anonymously (works for local/dev and public builds). NPM_TOKEN is optional and
+# only needed by internal builds that ingest new package versions into the feed.
+ARG NPM_REGISTRY=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
 ARG NPM_TOKEN
 
 RUN npm config set registry "$NPM_REGISTRY" && \

src/ubuntu/22.04/amd64/Dockerfile

@@ -96,13 +96,14 @@ RUN ARCH=$(dpkg --print-architecture) \
     && ln -s /opt/microsoft/powershell/pwsh /usr/bin/pwsh \
     && rm -f /tmp/powershell.tar.gz
 
-# Registry npm installs pull from; defaults to the Microsoft public npm proxy.
-# Internal builds override NPM_REGISTRY with the dotnet-public-npm Azure Artifacts feed and set NPM_TOKEN.
-ARG NPM_REGISTRY=https://packagefeedproxy.microsoft.io/npm/
+# npm registry. Defaults to the public dotnet-public-npm Azure Artifacts feed, which is
+# readable anonymously (works for local/dev and public builds). NPM_TOKEN is optional and
+# only needed by internal builds that ingest new package versions into the feed.
+ARG NPM_REGISTRY=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
 ARG NPM_TOKEN
 
 # Install Node 20 from NodeSource and use the patched npm ip module.
-# npm registry comes from NPM_REGISTRY (default proxy above); NPM_TOKEN adds auth for the internal feed.
+# npm registry comes from NPM_REGISTRY (default feed above); NPM_TOKEN only adds ingestion auth for internal builds.
 RUN cd /etc/apt/sources.list.d && \
     rm -f nodesource.list && \
     cd ~ && \

src/ubuntu/22.04/coredeps/amd64/Dockerfile

@@ -35,13 +35,14 @@ RUN apt-get update \
         uuid-dev \
     && rm -rf /var/lib/apt/lists/*
 
-# Registry npm installs pull from; defaults to the Microsoft public npm proxy.
-# Internal builds override NPM_REGISTRY with the dotnet-public-npm Azure Artifacts feed and set NPM_TOKEN.
-ARG NPM_REGISTRY=https://packagefeedproxy.microsoft.io/npm/
+# npm registry. Defaults to the public dotnet-public-npm Azure Artifacts feed, which is
+# readable anonymously (works for local/dev and public builds). NPM_TOKEN is optional and
+# only needed by internal builds that ingest new package versions into the feed.
+ARG NPM_REGISTRY=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
 ARG NPM_TOKEN
 
 # Install Node 20 from NodeSource and use the patched npm ip module.
-# npm registry comes from NPM_REGISTRY (default proxy above); NPM_TOKEN adds auth for the internal feed.
+# npm registry comes from NPM_REGISTRY (default feed above); NPM_TOKEN only adds ingestion auth for internal builds.
 RUN cd /etc/apt/sources.list.d && \
     rm -f nodesource.list && \
     cd ~ && \

src/ubuntu/22.04/helix/webassembly/amd64/Dockerfile

@@ -40,9 +40,10 @@ RUN locale-gen en_US.UTF-8
 COPY ./setup-node-23.x.sh /tmp
 RUN /tmp/setup-node-23.x.sh && apt-get -y install nodejs
 
-# Registry npm installs pull from; defaults to the Microsoft public npm proxy.
-# Internal builds override NPM_REGISTRY with the dotnet-public-npm Azure Artifacts feed and set NPM_TOKEN.
-ARG NPM_REGISTRY=https://packagefeedproxy.microsoft.io/npm/
+# npm registry. Defaults to the public dotnet-public-npm Azure Artifacts feed, which is
+# readable anonymously (works for local/dev and public builds). NPM_TOKEN is optional and
+# only needed by internal builds that ingest new package versions into the feed.
+ARG NPM_REGISTRY=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
 ARG NPM_TOKEN
 
 RUN npm config set registry "$NPM_REGISTRY" && \

src/ubuntu/24.04/Dockerfile

@@ -95,13 +95,14 @@ RUN ARCH=$(dpkg --print-architecture) \
     && ln -s /opt/microsoft/powershell/pwsh /usr/bin/pwsh \
     && rm -f /tmp/powershell.tar.gz
 
-# Registry npm installs pull from; defaults to the Microsoft public npm proxy.
-# Internal builds override NPM_REGISTRY with the dotnet-public-npm Azure Artifacts feed and set NPM_TOKEN.
-ARG NPM_REGISTRY=https://packagefeedproxy.microsoft.io/npm/
+# npm registry. Defaults to the public dotnet-public-npm Azure Artifacts feed, which is
+# readable anonymously (works for local/dev and public builds). NPM_TOKEN is optional and
+# only needed by internal builds that ingest new package versions into the feed.
+ARG NPM_REGISTRY=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
 ARG NPM_TOKEN
 
 # Install node 20 and use its bundled npm so we don't pull in distro npm dependencies unnecessarily.
-# npm registry comes from NPM_REGISTRY (default proxy above); NPM_TOKEN adds auth for the internal feed.
+# npm registry comes from NPM_REGISTRY (default feed above); NPM_TOKEN only adds ingestion auth for internal builds.
 RUN rm -f /etc/apt/sources.list.d/nodesource.list && \
     cd ~ && \
     curl -sL https://deb.nodesource.com/setup_20.x -o nodesource_setup.sh && \

src/ubuntu/24.04/helix/webassembly/amd64/Dockerfile

@@ -45,9 +45,10 @@ RUN chmod +x /tmp/setup-node-23.x.sh \
     && apt-get install -y nodejs \
     && rm -rf /var/lib/apt/lists/*
 
-# Registry npm installs pull from; defaults to the Microsoft public npm proxy.
-# Internal builds override NPM_REGISTRY with the dotnet-public-npm Azure Artifacts feed and set NPM_TOKEN.
-ARG NPM_REGISTRY=https://packagefeedproxy.microsoft.io/npm/
+# npm registry. Defaults to the public dotnet-public-npm Azure Artifacts feed, which is
+# readable anonymously (works for local/dev and public builds). NPM_TOKEN is optional and
+# only needed by internal builds that ingest new package versions into the feed.
+ARG NPM_REGISTRY=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
 ARG NPM_TOKEN
 
 RUN npm config set registry "$NPM_REGISTRY" && \