[ci] Keep NuGet revocation checks offline

[jonathanpeppers]

Summary

• set NUGET_CERT_REVOCATION_MODE=offline for Azure pipeline jobs
• prevent NuGet package-signing verification from contacting public OCSP responders in CFS network-isolated builds
• preserve the existing approved dotnet-public NuGet source and avoid adding network allowlists

Investigation

AndroidX pipeline 12322 network-isolation telemetry showed ocsp.sectigo.com, ocsp.comodoca.com, and ocsp.entrust.net requests from dotnet.exe in the Windows build job. NuGet.org and Maven Central package traffic is already routed through repository-standard Azure Artifacts feeds on main.

References

• NuGet warning NU3028 recommends NUGET_CERT_REVOCATION_MODE=offline for CI/build machines with restricted internet access.
• NuGet environment variables
• NuGet.Client implementation
• NuGet.Client tests

Validation

• dotnet tool restore --configfile NuGet.config with NUGET_CERT_REVOCATION_MODE=offline
• git diff --check

[Copilot]

Pull request overview

Updates the Azure Pipelines shared CI variables to keep NuGet package-signing certificate revocation checks offline, preventing dotnet/NuGet from attempting outbound OCSP requests in network-isolated builds.

Changes:

• Set NUGET_CERT_REVOCATION_MODE=offline in the CI variables template to avoid contacting public OCSP responders during package signature verification.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[jonathanpeppers]

@dalexsoto review

[dalexsoto]

The documented NuGet revocation setting is applied through both pipeline entry points, inherited by all jobs, and the full CI build passes with no new network allowlist.