official-release-nuget.config

<?xml version="1.0" encoding="utf-8"?>
<!--
  Official-release NuGet configuration. Pipeline-only.

  Used by the official release pipeline ONLY, supplied at build time via
  -ConfigFile to a one-off `nuget install Microsoft.Build.Vcpkg` command
  that fetches the Terrapin retrieval tool. The root nuget.config (the
  one external contributors and the public GitHub Actions workflow use)
  does NOT reference this internal feed, so building VFS for Git from a
  fresh clone requires no internal authentication.

  Why this file exists:
    Microsoft.Build.Vcpkg is an internal-only NuGet package that ships
    the proprietary TerrapinRetrievalTool.exe. The release pipeline
    downloads the package out-of-band (i.e. not via msbuild SDK
    resolution, which would force the internal feed into the root
    nuget.config and expose it to every consumer) and passes the path to
    the extracted retrieval tool via -p:TerrapinRetrievalToolPath. vcpkg
    then routes its asset downloads through the Terrapin cache, because
    the release pipeline's build agents have x-block-origin enforced at
    the network layer and cannot fetch from public origins
    (sourceforge.net, github.com release artifacts, etc.).
-->
<configuration>
  <packageSources>
    <clear />
    <add key="GitClient" value="https://pkgs.dev.azure.com/mseng/1ES/_packaging/GitClient/nuget/v3/index.json" />
  </packageSources>
</configuration>