build(wrapper): install only what the wrapper pipeline uses (main) (#3758)

* build(wrapper): install only what the wrapper pipeline uses

The pipeline reused install-tools.yml wholesale, which is the AutoRest
toolchain - Node, the private npm feed, AutoRest, Rush and a full rush
rebuild - none of which the wrapper build touches, and it installs .NET 8/6
while the generator targets net10.0. The build step then failed because
Build-WrapperModule.ps1 refuses to run without the kiota CLI on PATH even
under -SkipKiota. Installs the .NET 10 SDK, feed auth, and kiota explicitly.

* build(wrapper): route NuGet through the internal feed under network isolation

api.nuget.org is not reliably reachable from the 1ES pool, so the kiota tool
install failed loading the service index - and the module restore would have
failed the same way one step later. Writes a pipeline-local nuget.config that
puts the MSGraph_PowerShell_V3_Build feed (whose upstream proxies nuget.org)
first with nuget.org as fallback, used by every restore on the run.
NuGetAuthenticate supplies the credentials; the kiota step also retries.

* build(wrapper): feed-only NuGet sources under network isolation

dotnet tool install probes the service index of every configured source and
fails hard if any is unreachable, so keeping nuget.org as a fallback defeated
the routing entirely. The pipeline config now lists only the internal feed,
whose upstream proxies nuget.org, and the install ignores failed sources.

* build(wrapper): run the full generation chain at pipeline time

Per review: the pipeline now generates the kiota client from the committed
OpenAPI docs and the wrappers on top, then compiles - the whole process is
built and tested end to end on every run, and a run can never fail on
committed clients lagging the docs. Clients remain committed to the repo for
reviewable diffs and clean local checkouts.

* build(wrapper): suppress credscan false positives in generated synchronization models

The kiota-generated model for Graph's synchronizationSecret entity enumerates
the API's secret-key names (Oauth2ClientSecret and similar) as enum member
strings, which trips CSCAN-GENERAL0120 in four modules and breaks the guardian
post-analysis. Schema vocabulary from the OpenAPI document, not secret values -
same class of suppression the file already carries for generated examples.

Author: Joywambui-maina

.azure-pipelines/config/credscan/credscan-suppressions.json

@@ -73,6 +73,15 @@
         "tools\\Tests\\loadEnv.md"
       ],
       "_justification": "[ToolsTest] Examples contain random values recognized as secret"
+    },
+    {
+      "file": [
+        "src\\Applications\\wrapper\\v1.0\\Client\\Models\\SynchronizationSecret.cs",
+        "src\\Groups\\wrapper\\v1.0\\Client\\Models\\SynchronizationSecret.cs",
+        "src\\Identity.DirectoryManagement\\wrapper\\v1.0\\Client\\Models\\SynchronizationSecret.cs",
+        "src\\Users\\wrapper\\v1.0\\Client\\Models\\SynchronizationSecret.cs"
+      ],
+      "_justification": "[Wrapper] Kiota-generated model for Graph's synchronizationSecret entity enumerates the API's secret-key names (Oauth2ClientSecret and similar) as enum member strings; these are schema vocabulary from the OpenAPI document, not secret values"
     }
   ]
 }

.azure-pipelines/wrapper-release.yml

@@ -74,7 +74,51 @@ extends:
         - script: git submodule update --init --recursive
           displayName: Initialize submodules
 
-        - template: .azure-pipelines/common-templates/install-tools.yml@self
+        # Deliberately NOT install-tools.yml: that template is the AutoRest toolchain - Node,
+        # the private npm feed, AutoRest, Rush and a full rush rebuild - none of which this
+        # pipeline uses. The wrapper modules compile from committed sources, so the whole
+        # toolchain is the .NET SDK, feed auth for restore, and the kiota CLI.
+        - task: UseDotNet@2
+          displayName: Use .NET SDK 10
+          retryCountOnTaskFailure: 2
+          inputs:
+            version: 10.x
+        - task: NuGetAuthenticate@1
+        # Under 1ES network isolation api.nuget.org is not reliably reachable, so every restore
+        # on this pipeline - the kiota tool below and the module build after it - resolves
+        # through the team's own feed first, whose upstream proxies nuget.org. The config is
+        # written at the sources root so dotnet picks it up everywhere; NuGetAuthenticate above
+        # supplies the credentials.
+        - task: PowerShell@2
+          displayName: Route NuGet through the internal feed
+          inputs:
+            targetType: inline
+            pwsh: true
+            script: |
+              $cfg = @'
+              <?xml version="1.0" encoding="utf-8"?>
+              <configuration>
+                <packageSources>
+                  <clear />
+                  <add key="MSGraphV3" value="https://pkgs.dev.azure.com/microsoftgraph/Graph%20Developer%20Experiences/_packaging/MSGraph_PowerShell_V3_Build/nuget/v3/index.json" />
+                </packageSources>
+              </configuration>
+              '@
+              Set-Content -Path '$(Build.SourcesDirectory)/nuget.config' -Value $cfg -Encoding utf8
+              Write-Host "wrote $(Build.SourcesDirectory)/nuget.config"
+        # Build-WrapperModule.ps1 refuses to run without kiota on PATH even under -SkipKiota
+        # (the guard is unconditional), and future -Generate runs need it anyway.
+        - task: PowerShell@2
+          displayName: Install kiota CLI
+          retryCountOnTaskFailure: 2
+          inputs:
+            targetType: inline
+            pwsh: true
+            workingDirectory: $(Build.SourcesDirectory)
+            script: |
+              dotnet tool install --global Microsoft.OpenApi.Kiota --configfile '$(Build.SourcesDirectory)/nuget.config' --ignore-failed-sources
+              if ($LASTEXITCODE -ne 0) { throw "kiota install failed with exit code $LASTEXITCODE" }
+              Write-Host "##vso[task.prependpath]$env:USERPROFILE\.dotnet\tools"
         - template: .azure-pipelines/common-templates/security-pre-checks.yml@self
 
         # Version and prerelease go to the script directly (-ModuleVersion/-Prerelease); the
@@ -92,7 +136,11 @@ extends:
                 ArtifactsLocation = '$(Build.ArtifactStagingDirectory)'
                 ModuleVersion     = '${{ parameters.PackageVersion }}'
                 Prerelease        = '$(WrapperPrerelease)'
-                SkipKiota         = $true
+                # Deliberately NOT -SkipKiota: the pipeline runs the whole chain - kiota client
+                # generation from the committed OpenAPI docs, wrapper generation on top, then
+                # compile - so a change in any step is built and tested end to end, and the run
+                # can never fail on committed clients lagging the docs. Clients are still
+                # committed to the repo for reviewable diffs and clean local checkouts.
                 Pack              = $true
               }
               & '$(Build.SourcesDirectory)/tools/Build-WrapperModule.ps1' @params