Primary nuget pipeline runs with CFS clean.

tools/ci_build/github/azure-pipelines/c-api-noopenmp-packaging-pipelines-cuda13.yml

@@ -87,7 +87,7 @@ extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
   parameters:
     settings:
-      networkIsolationPolicy: Permissive
+      networkIsolationPolicy: CFSClean2,CFSClean3,DefaultDeny
     featureFlags:
       binskimScanAllExtensions: true
     sdl:

tools/ci_build/github/azure-pipelines/c-api-noopenmp-packaging-pipelines.yml

@@ -120,6 +120,9 @@ extends:
   # For productions pipelines, use "Official".
   template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
   parameters:
+    # Waiting on the Dawn changes to land
+    settings:
+      networkIsolationPolicy: CFSClean,CFSClean2,CFSClean3,DefaultDeny
     featureFlags:
       binskimScanAllExtensions: true
     sdl:

tools/ci_build/github/azure-pipelines/c-api-noopenmp-test-pipelines.yml

@@ -77,19 +77,6 @@ stages:
       artifactName: 'onnxruntime-android-full-aar'
       ReleaseVersionSuffix: $(ReleaseVersionSuffix)
 
-- stage: Final_AAR_Testing_Android_QNN
-  dependsOn: Setup
-  variables:
-    ReleaseVersionSuffix: $[ stageDependencies.Setup.Restore_And_Use_Variables.outputs['Set_Release_Version_Suffix.ReleaseVersionSuffix'] ]
-  jobs:
-  - template: templates/android-java-api-aar-test.yml
-    parameters:
-      artifactName: 'onnxruntime-android-qnn-aar'
-      packageName: 'onnxruntime-android-qnn'
-      #TODO: get this information from the setup stage
-      QnnSDKVersion: '2.42.0.251225'
-      ReleaseVersionSuffix: $(ReleaseVersionSuffix)
-
 - template: nuget/templates/test_win.yml
   parameters:
     AgentPool: 'onnxruntime-Win-CPU-VS2022-Latest'

tools/ci_build/github/azure-pipelines/custom-nuget-packaging-pipeline.yml

@@ -50,6 +50,8 @@ extends:
   # For productions pipelines, use "Official".
   template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
   parameters:
+    settings:
+      networkIsolationPolicy: CFSClean,CFSClean2,CFSClean3,DefaultDeny
     featureFlags:
       binskimScanAllExtensions: true
     sdl:

tools/ci_build/github/azure-pipelines/templates/android-java-api-aar.yml

@@ -82,6 +82,10 @@ jobs:
   steps:
   - template: jobs/checkout-and-git-redirect.yml
 
+  - template: setup-feeds-and-python-steps.yml
+    parameters:
+      architecture: x64
+
   - task: CmdLine@2
     displayName: Create artifacts directory
     inputs:
@@ -127,6 +131,10 @@ jobs:
           --volume $NDK_HOME:/ndk_home \
           --volume $(Build.BinariesDirectory)/.artifacts:/home/onnxruntimedev/.artifacts \
           --volume $(Build.BinariesDirectory)/.build_settings:/home/onnxruntimedev/.build_settings \
+          --volume "${NPM_CONFIG_USERCONFIG}:/tmp/.npmrc:ro" \
+          --volume "$HOME/.m2:/home/onnxruntimedev/.m2:ro" \
+          --volume "$HOME/.gradle:/home/onnxruntimedev/.gradle" \
+          --volume "${HOME}/.gitconfig:/home/onnxruntimedev/.gitconfig:ro" \
           $QNN_VOLUME \
           -e NIGHTLY_BUILD \
           -e BUILD_BUILDNUMBER \
@@ -135,6 +143,8 @@ jobs:
           -e PUBLISH_EXECUTABLES=${{parameters.publish_executables}} \
           -e PACKAGE_NAME=${{parameters.packageName}} \
           -e RELEASE_VERSION_SUFFIX=${{parameters.ReleaseVersionSuffix}} \
+          -e NPM_CONFIG_USERCONFIG=/tmp/.npmrc \
+          -e PIP_INDEX_URL \
           onnxruntimecpubuildcentos8x64_packaging \
             /bin/bash /onnxruntime_src/tools/ci_build/github/android/build_aar_and_copy_artifacts.sh $USE_QNN
       workingDirectory: $(Build.SourcesDirectory)

tools/ci_build/github/azure-pipelines/templates/c-api-linux-cpu.yml

@@ -75,6 +75,7 @@ jobs:
         -e NPM_CONFIG_USERCONFIG=/tmp/.npmrc \
         -e PIP_INDEX_URL \
         --volume "${NPM_CONFIG_USERCONFIG}:/tmp/.npmrc:ro" \
+        --volume "${HOME}/.gitconfig:/home/onnxruntimedev/.gitconfig:ro" \
         --volume $HOME/.m2:/home/onnxruntimedev/.m2:ro \
         --volume $HOME/.gradle:/home/onnxruntimedev/.gradle \
         --volume $HOME/.onnx:/home/onnxruntimedev/.onnx -e NIGHTLY_BUILD onnxruntimecpubuildcentos8${{parameters.OnnxruntimeArch}}_packaging /bin/bash -c "python3 \

tools/ci_build/github/azure-pipelines/templates/esrp_nuget.yml

@@ -5,7 +5,7 @@ parameters:
 
 steps:
 - ${{ if eq(parameters['DoEsrp'], 'true') }}:
-  - task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@5
+  - task: EsrpCodeSigning@6
     displayName: 'ESRP CodeSigning'
     inputs:
       ConnectedServiceName: 'OnnxrunTimeCodeSign_20240611'

tools/ci_build/github/azure-pipelines/templates/mac-esrp-dylib.yml

@@ -8,7 +8,7 @@ parameters:
   default: '*.zip'
 
 steps:
-- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@5
+- task: EsrpCodeSigning@6
   displayName: 'ESRP CodeSigning'
   inputs:
     ConnectedServiceName: 'OnnxrunTimeCodeSign_20240611'

tools/ci_build/github/azure-pipelines/templates/setup-feeds-and-python-steps.yml

@@ -163,7 +163,8 @@ steps:
         Set-Content $m2SettingsXmlPath
 
 
-      # gradle - inject 1ES feed repo into all projects/buildscripts. Auth using creds from maven settings.xml.
+      # gradle - inject 1ES feed repo into plugin management, all projects, and buildscripts.
+      # Auth using creds from maven settings.xml.
       # nb: see HACK note above.
       $gradleInitDir = if ($env:GRADLE_HOME_DIR) { $env:GRADLE_HOME_DIR } else { "~/.gradle" }
       if (!(Test-Path -Path "${gradleInitDir}/init.d")) {
@@ -185,6 +186,22 @@ steps:
         }
       }
 
+      settingsEvaluated { settings ->
+        settings.pluginManagement {
+          repositories {
+            clear()
+            maven {
+              name "1ES Feed"
+              url uri("https://aiinfra.pkgs.visualstudio.com/_packaging/${env:central_maven_feed_name}/maven/v1")
+              credentials(PasswordCredentials) {
+                username oneEsFeedCredentials().username
+                password oneEsFeedCredentials().password
+              }
+            }
+          }
+        }
+      }
+
       allprojects {
         buildscript {
           repositories {

tools/ci_build/github/azure-pipelines/templates/win-esrp-dll.yml

@@ -16,7 +16,7 @@ parameters:
   default: '*.dll'
 
 steps:
-- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@5
+- task: EsrpCodeSigning@6
   displayName: ${{ parameters.DisplayName }}
   condition: and(succeeded(), eq('${{ parameters.DoEsrp }}', true))
   inputs: