Context

The CG scan of the VMR showed that since the VMR is missing a root NuGet.config, some of the projects from the SourceBuild infra don't have a matching one. Each project needs to have one so that some other global one is not used.

CFS0011 alert info: https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/secure-supply-chain/project-artemis/central-feed-services-cfs#3-cfs0011---c-projects-are-missing-feed-configuration

Offending files

• eng/bootstrap/buildBootstrapPreviouslySB.csproj
• test/Microsoft.DotNet.SourceBuild.SmokeTests/Microsoft.DotNet.SourceBuild.SmokeTests.csproj
• tools-local/tasks/Microsoft.DotNet.SourceBuild.Tasks.XPlat/Microsoft.DotNet.SourceBuild.Tasks.XPlat.csproj
• tools-local/tasks/SourceBuild.MSBuildSdkResolver/SourceBuild.MSBuildSdkResolver.csproj

Solution

I believe we should add a NuGet.config to VMR's root or next to these files. I am not sure what feeds this needs to configure though.