Resolve Gradle dependencies through the azfunc Azure Artifacts feed

[Varshitha Bachu (bachuv)]

Issue describing the changes in this PR

Configures the CI build to resolve Maven-format dependencies from the upstream-public
Azure Artifacts feed instead of public Maven Central

Changes

• Adds init.gradle (applied in CI via --init-script): for every project it removes any
  Maven Central repository and replaces it with
  https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1, so the build
  no longer reaches repo.maven.apache.org. Feed credentials come from the build identity via
  AZURE_ARTIFACTS_ENV_ACCESS_TOKEN (no stored secret). When no token is present (external clones /
  local dev), the feed is read anonymously, so external contributors are unaffected.
• eng/templates/build.yml: both Gradle@3 tasks now pass --init-script init.gradle.

Pull request checklist

• My changes do not require documentation changes
  • Otherwise: Documentation issue linked to PR
• My changes are added to the CHANGELOG.md
• I have added all required tests (Unit tests, E2E tests)

[Copilot]

Pull request overview

This PR configures CI Gradle builds to avoid resolving dependencies from Maven Central by injecting a Gradle init script that removes Maven Central repositories and adds the upstream-public Azure Artifacts Maven feed, then wiring that init script into the CI Gradle tasks.

Changes:

• Added init.gradle to remove Maven Central repositories and add the azfunc Azure Artifacts Maven feed (with optional token-based credentials).
• Updated eng/templates/build.yml Gradle tasks to pass --init-script init.gradle so CI uses the feed.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
init.gradle	Adds an init script to remove Maven Central repos and add the azfunc Azure Artifacts Maven feed (optionally authenticated).
eng/templates/build.yml	Passes --init-script init.gradle to Gradle tasks so CI resolves dependencies via the feed.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[andystaples]

Thanks for wiring dependency resolution through upstream-public. This is close, but run 20260820.2 still recorded 10 CFSClean2 violations from plugins.gradle.org / plugins-artifacts.gradle.org. The Gradle log shows the Azure feed returning missing for the SpotBugs plugin marker and implementation, followed by resolution from Plugin Portal.

I worked with the feed admin to enable the Gradle Plugins upstream on upstream-public, and verified that the SpotBugs 6.4.8 marker POM plus its implementation POM, module metadata, and JAR now all resolve from the feed (HTTP 200). Please make plugin resolution feed-only now:

 pluginManagement {
     repositories {
         maven {
             url 'https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1'
             // existing credentials
         }
-        gradlePluginPortal()
     }
 }

The init script should also allow-list the Azure Artifacts feed rather than remove only Maven Central. This repo still declares oss.sonatype.org, which is another CFSClean2 endpoint, and host-specific deny-listing leaves future public repositories able to bypass CFS. The current EngHub Gradle guidance recommends checking both project and buildscript repositories and removing every non-Azure-Artifacts Maven repository (optionally preserving MavenLocal). For example, base the predicate on:

repo instanceof MavenArtifactRepository &&
repo.name != 'MavenLocal' &&
!repo.url.toString().startsWith('https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1')

Please apply that policy to both project.repositories and project.buildscript.repositories, then rerun with a cold Gradle cache and confirm CFSClean, CFSClean2, and CFSClean3 are all compliant.

[andystaples]

The latest changes address my review: authenticated internal builds resolve project, buildscript, and plugin dependencies through upstream-public, while unauthenticated GitHub/external builds retain the public Plugin Portal fallback. GitHub Actions passes, and official ADO run 20260820.4 reports CFSClean, CFSClean2, CFSClean3, and Default Deny all compliant with no blocked connections.