From 64de9c8c1c1e8ed73c3b76e67e4e3ef18ad6ddce Mon Sep 17 00:00:00 2001
From: AmirMS <104940545+AmelBawa-msft@users.noreply.github.com>
Date: Mon, 22 Jun 2026 16:40:26 -0700
Subject: [PATCH 1/3] Update Azure Pipelines configuration

---
 pipelines/azure-pipelines.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pipelines/azure-pipelines.yml b/pipelines/azure-pipelines.yml
index e90ac7f5..d95a3282 100644
--- a/pipelines/azure-pipelines.yml
+++ b/pipelines/azure-pipelines.yml
@@ -36,6 +36,7 @@ extends:
       - ES365AIMigrationTooling
     settings:
       skipBuildTagsForGitHubPullRequests: true
+      networkIsolationPolicy: Permissive,CFSClean,CFSClean2,CFSClean3
 
     stages:
       - stage: WinGet_DSC_Artifacts_Publish

From b3f13bc213951831bd381d0ed99c477447519a83 Mon Sep 17 00:00:00 2001
From: AmirMS <104940545+AmelBawa-msft@users.noreply.github.com>
Date: Tue, 23 Jun 2026 14:14:12 -0700
Subject: [PATCH 2/3] Update feed

---
 pipelines/azure-pipelines.yml                 | 24 ++++++++++++++++++-
 .../Microsoft.DotNet.Dsc.Tests.ps1            |  4 +++-
 .../Microsoft.Windows.Developer.Tests.ps1     |  4 +++-
 3 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/pipelines/azure-pipelines.yml b/pipelines/azure-pipelines.yml
index d95a3282..323cb9b0 100644
--- a/pipelines/azure-pipelines.yml
+++ b/pipelines/azure-pipelines.yml
@@ -36,7 +36,9 @@ extends:
       - ES365AIMigrationTooling
     settings:
       skipBuildTagsForGitHubPullRequests: true
-      networkIsolationPolicy: Permissive,CFSClean,CFSClean2,CFSClean3
+      # CFSClean is omitted so NpmDsc can reach registry.npmjs.org. CFSClean2 (PowerShell Gallery)
+      # and CFSClean3 are enforced; PowerShell modules are sourced from an internal feed instead.
+      networkIsolationPolicy: Permissive,CFSClean2,CFSClean3
 
     stages:
       - stage: WinGet_DSC_Artifacts_Publish
@@ -95,6 +97,26 @@ extends:
                 clean: true
                 fetchTags: false
 
+              - task: PowerShell@2
+                displayName: "Install PSDesiredStateConfiguration from internal feed"
+                env:
+                  SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+                inputs:
+                  pwsh: true
+                  targetType: "inline"
+                  # PowerShell Gallery is blocked by CFSClean2, so the module is pulled from an
+                  # internal Azure Artifacts feed that has PowerShell Gallery as an upstream source.
+                  script: |
+                    $token = $env:SYSTEM_ACCESSTOKEN | ConvertTo-SecureString -AsPlainText -Force
+                    $credential = [System.Management.Automation.PSCredential]::new('AzureDevOps', $token)
+                    $feedUri = 'https://pkgs.dev.azure.com/shine-oss/winget-dsc/_packaging/WinGetDscDependencies/nuget/v3/index.json'
+                    $repoName = 'WinGetDscDependencies'
+                    if (-not (Get-PSResourceRepository -Name $repoName -ErrorAction SilentlyContinue)) {
+                        Register-PSResourceRepository -Name $repoName -Uri $feedUri -Trusted
+                    }
+                    Install-PSResource -Name PSDesiredStateConfiguration -Version '2.0.7' -Repository $repoName -Credential $credential -TrustRepository
+                    Get-Module -Name PSDesiredStateConfiguration -ListAvailable | Select-Object Name, Version
+
               - task: PowerShell@2
                 displayName: "Run Pester tests for DSC modules"
                 inputs:
diff --git a/tests/Microsoft.DotNet.Dsc/Microsoft.DotNet.Dsc.Tests.ps1 b/tests/Microsoft.DotNet.Dsc/Microsoft.DotNet.Dsc.Tests.ps1
index 4b60c6c8..c25f6eca 100644
--- a/tests/Microsoft.DotNet.Dsc/Microsoft.DotNet.Dsc.Tests.ps1
+++ b/tests/Microsoft.DotNet.Dsc/Microsoft.DotNet.Dsc.Tests.ps1
@@ -11,7 +11,9 @@ Set-StrictMode -Version Latest
 #>
 
 BeforeAll {
-    Install-Module -Name PSDesiredStateConfiguration -Force -SkipPublisherCheck
+    if ((Get-Module -Name PSDesiredStateConfiguration -ListAvailable).Version -ne '2.0.7') {
+        Install-Module -Name PSDesiredStateConfiguration -Force -SkipPublisherCheck -RequiredVersion '2.0.7'
+    }
     Import-Module Microsoft.DotNet.Dsc
 
     $script:toolsDir = Join-Path $env:USERPROFILE 'tools'
diff --git a/tests/Microsoft.Windows.Developer/Microsoft.Windows.Developer.Tests.ps1 b/tests/Microsoft.Windows.Developer/Microsoft.Windows.Developer.Tests.ps1
index 68dd4383..81107ab3 100644
--- a/tests/Microsoft.Windows.Developer/Microsoft.Windows.Developer.Tests.ps1
+++ b/tests/Microsoft.Windows.Developer/Microsoft.Windows.Developer.Tests.ps1
@@ -12,7 +12,9 @@ Set-StrictMode -Version Latest
 # InModuleScope ensures that all mocks are on the Microsoft.Windows.Developer module.
 InModuleScope Microsoft.Windows.Developer {
    BeforeAll {
-      Install-Module -Name PSDesiredStateConfiguration -Force -SkipPublisherCheck
+      if ((Get-Module -Name PSDesiredStateConfiguration -ListAvailable).Version -ne '2.0.7') {
+         Install-Module -Name PSDesiredStateConfiguration -Force -SkipPublisherCheck -RequiredVersion '2.0.7'
+      }
       Import-Module Microsoft.Windows.Developer
 
       # Create test registry path.

From 9ab49a16dfe8dffe1fac476f24ec40371f8e5bfc Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 23 Jun 2026 21:42:07 +0000
Subject: [PATCH 3/3] Allow new pipeline spelling terms

---
 .github/actions/spelling/allow.txt | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt
index 395cd5a3..9fb7514f 100644
--- a/.github/actions/spelling/allow.txt
+++ b/.github/actions/spelling/allow.txt
@@ -1,4 +1,5 @@
 admins
+ACCESSTOKEN
 apps
 appwiz
 appx
@@ -56,11 +57,13 @@ mubaidr
 NOLOGO
 NOLOGO
 nonexistentpackage
+npmjs
 numpy
 NVM
 opencode
 onboarding
 opensource
+oss
 pkief
 powertoys
 prerel
@@ -74,6 +77,7 @@ reduxjs
 requ
 restsource
 ritwickdey
+sourced
 tastejs
 todomvc
 toolsai