Fix MicroBuild plugin feed URL to use allowed pkgs.dev.azure.com format

[AlesProkop]

Fixes

The official MSBuild build (DotNet-msbuild-Trusted, DevDiv pipeline "MSBuild" / def 9434) has been failing on main since 2026-07-08 at the Install MicroBuild plugin step:

##[error]The feedSource input 'https://devdiv.pkgs.visualstudio.com/_packaging/MicroBuildToolset/nuget/v3/index.json'
is not an allowed feed. It must start with one of: https://pkgs.dev.azure.com/devdiv,
https://pkgs.dev.azure.com/dnceng, https://pkgs.dev.azure.com/msctoproj, https://pkgs.dev.azure.com/mseng,
https://pkgs.dev.azure.com/xamarin, https://pkgs.dev.azure.com/devdiv-test, https://dnceng.pkgs.visualstudio.com

Because the signing plugin fails to install, the build produces no artifacts and every downstream step (Move/Publish artifacts) fails as well. This blocks new signed builds and therefore VS insertion payloads.

Context

The MicroBuild Signing Plugin (v4) now enforces an allow-list of feed sources. The legacy https://devdiv.pkgs.visualstudio.com URL form is no longer accepted; the equivalent Azure DevOps URL https://pkgs.dev.azure.com/devdiv is. (Arcade's eng/common/core-templates/steps/install-microbuild.yml already uses an allowed dnceng URL; only this msbuild-specific pipeline file still used the legacy form.)

Changes Made

In azure-pipelines/.vsts-dotnet-build-jobs.yml, update the feedSource for both MicroBuild tasks to the allowed pkgs.dev.azure.com/devdiv form (same MicroBuildToolset feed, new URL form):

• MicroBuildSigningPlugin@4
• MicroBuildOptProfPlugin@6

Testing

Config-only change; validated by the official build pipeline running on this PR.

[Copilot]

Pull request overview

Updates the DevDiv official build pipeline configuration to use the MicroBuild plugin feed URL format that is now allow-listed (pkgs.dev.azure.com), unblocking installation of the signing/optprof plugins and restoring production of signed build artifacts.

Changes:

• Switch MicroBuild Signing Plugin feedSource to https://pkgs.dev.azure.com/devdiv/... for the MicroBuildToolset feed.
• Switch MicroBuild OptProf Plugin feedSource to the same allowed https://pkgs.dev.azure.com/devdiv/... URL form.

[github-actions]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection results could not be parsed.

Review the workflow run logs for details.

MSBuild 24-Dimension Code Review

✅ 23/24 dimensions clean. One NIT finding.

Findings

#	Dimension	Verdict	Severity
18	Documentation Accuracy	NIT	Consider an inline comment explaining the allowlist requirement

All other dimensions (1–17, 19–24) are LGTM.

Notable validations

• Correctness (dim 22): The /DefaultCollection/ removal in the second hunk is correct — the canonical pkgs.dev.azure.com/{org}/_packaging/... scheme never includes that legacy TFS path segment. The pre-fix second URL was inconsistent with the first; both new URLs are now identical and correct.
• Security (dim 24): pkgs.dev.azure.com/devdiv is the verified canonical replacement for devdiv.pkgs.visualstudio.com — same organization, same feed, new URL scheme enforced by policy. No new external domains introduced.
• Build Infrastructure (dim 19): eng/common uses dnceng.pkgs.visualstudio.com, which is on the allow-list per the error message in this PR. No other pipeline files need changes.

The fix is correct and unblocks the broken official build. The NIT is purely advisory.

Generated by Expert Code Review (on open) for #14295 · 434.8 AIC · ⊞ 30.4K

[github-actions]

NIT: Consider adding a short inline comment explaining why this specific URL format is required — a future contributor who knows only the legacy devdiv.pkgs.visualstudio.com pattern might silently revert this, triggering the same breakage.

# devdiv.pkgs.visualstudio.com is no longer on the MicroBuild plugin allow-list; use pkgs.dev.azure.com/devdiv instead.
feedSource: (pkgs.dev.azure.com/redacted)