[ci] Prevent isolated NuGet access

[jonathanpeppers]

Why

Internal build 14925232 reported CFSClean violations during Create MAUI template. The pipeline needs to suppress three independent .NET network paths:

1. DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE=true prevents background workload advertising-manifest updates.
2. DOTNET_SDK_VULNERABILITY_CHECK_DISABLE=true prevents the .NET CLI's separate background SDK release/vulnerability/EOL metadata refresh. The SDK invokes this refresh from restoring commands such as dotnet build and dotnet restore.
3. NuGetAudit=false disables NuGet restore's package-advisory lookup. This is a distinct MSBuild property and does not replace the SDK-level variable.

The immediate MAUI violation came from dotnet new maui, which runs a restore post-action by default. That restore had no project-specific NuGet.config, so it contacted public NuGet and workload advertising-manifest hosts. Passing --no-restore creates the template without running that post-action.

This does not remove the intended MAUI restore/build. The following Debug and Release build steps remain unchanged and explicitly pass --configfile $(Build.SourcesDirectory)/maui/NuGet.config, keeping package acquisition on the configured sources. Disabling these metadata checks also does not disable package hash/signature validation; it prevents external metadata lookups in network-isolated jobs.

Changes

• Retain DOTNET_SDK_VULNERABILITY_CHECK_DISABLE=true and add NuGetAudit=false alongside it in shared pipeline variables and the internal override.
• Add --no-restore to MAUI template creation in the main, public, and internal pipeline definitions.

Validation

• Parsed all changed YAML files successfully.

• Ran git diff --check.

• Verified every MAUI template-creation variant uses --no-restore.

• Verified all three isolation controls remain present where expected.

• Verified dotnet new --no-restore creates a project without producing a restore assets file.

• Confirmed the separate SDK behavior in RestoringCommand and SdkReleaseMetadataCache.

• Useful description of why the change is necessary.

• Links to issues fixed (build link above; no GitHub issue).

• Unit tests (not applicable to pipeline-only YAML; targeted checks listed above).

[Copilot]

Pull request overview

This PR hardens the Azure Pipelines MAUI template validation steps against unintended network access in network-isolated jobs by (1) disabling NuGet’s restore auditing via the supported NuGetAudit MSBuild property and (2) preventing dotnet new maui from running its default restore post-action.

Changes:

• Replace DOTNET_SDK_VULNERABILITY_CHECK_DISABLE with NuGetAudit=false in shared pipeline variables (and internal override) to stop vulnerability index lookups during restore.
• Add --no-restore to the dotnet new maui template creation steps across main/public/internal pipeline definitions.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
build-tools/automation/yaml-templates/variables.yaml	Sets NuGetAudit=false in shared pipeline variables to disable NuGet restore auditing.
build-tools/automation/azure-pipelines.yaml	Adds --no-restore when creating the MAUI template to prevent restore post-actions.
build-tools/automation/azure-pipelines-public.yaml	Mirrors the MAUI template --no-restore change for the public pipeline.
build-tools/automation/azure-pipelines-internal.yaml	Sets NuGetAudit=false for internal runs and adds --no-restore to MAUI template creation.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[jonathanpeppers]

@dalexsoto review

[dalexsoto]

Blocking on one isolation regression. Please retain DOTNET_SDK_VULNERABILITY_CHECK_DISABLE=true and add NuGetAudit=false alongside it. They disable separate network paths: NuGet package auditing versus the .NET CLI’s background SDK release and vulnerability metadata refresh. Replacing the existing variable can reintroduce undeclared external egress during later dotnet build steps. The --no-restore MAUI template changes otherwise look correct.

[jonathanpeppers]

Addressed in 40e9731: restored DOTNET_SDK_VULNERABILITY_CHECK_DISABLE=true alongside NuGetAudit=false in both shared and internal variables. The controls are separate: dotnet/sdk RestoringCommand triggers the SDK release/vulnerability metadata cache refresh, while NuGetAudit controls package advisory lookup. I also corrected the PR description and added links to the relevant dotnet/sdk source. Re-requesting review.