CI Tests: PowerShellEditorServices build cannot restore .NET reference packs (NuGet feed returns 401), failing every branch since 2026-06-25

[PtJade-Ceramic]

CI Tests has failed on every branch since 2026-06-25, including main (the last successful run was 2026-06-25). It fails in the Build, test and package step while building the sibling PowerShellEditorServices checkout, before any of this repository's own tests run:

error : Failed to download package 'Microsoft.NETCore.App.Ref.8.0.31' from 'https://pkgs.dev.azure.com/powershell/.../nuget/v3/flat2/microsoft.netcore.app.ref/8.0.31/microsoft.netcore.app.ref.8.0.31.nupkg'.
error : Response status code does not indicate success: 401 (Unauthorized - No local versions of package 'microsoft.netcore.app.ref'; please provide authentication to access versions from upstream that have not yet been saved to your feed.)

PowerShellEditorServices/nuget.config clears all sources and only lists https://pkgs.dev.azure.com/powershell/PowerShell/_packaging/powershell/nuget/v3/index.json. That feed's index.json is public (HTTP 200), but package downloads return 401 to anonymous clients, for both the name-based and GUID-based URLs, e.g. microsoft.netcore.app.ref 8.0.19 and 8.0.31. The same package is publicly downloadable from nuget.org (HTTP 302). Since ci-test.yml checks out PSES's default branch and builds it, public GitHub runners can no longer restore these .NET reference packs.

Effect: no PR can get a green CI Tests run; several PRs (e.g. #5558) are stuck on this.

Workaround that unblocks a run — add nuget.org to the sources after checking out PSES (see the temporary commit in #5558):

- name: Add nuget.org to the PowerShellEditorServices sources
  shell: pwsh
  run: |
    # keep the PowerShell feed, add nuget.org as a fallback for the ref packs

With it, the build succeeds and the extension's tests actually execute (the remaining macOS failure in that run was the unrelated, flaky VS Code Insiders download: spawn ... Electron ENOENT).

Suggested fixes (maintainer's call):

1. Add nuget.org to PowerShellEditorServices/nuget.config, or enable anonymous upstream access on the feed.
2. Check out a pinned PSES tag in ci-test.yml rather than its default branch.

[PtJade-Ceramic]

Update from #5558: adding nuget.org as a source and mapping the framework reference packs to it via packageSourceMapping (Microsoft.NETCore.App.*, Microsoft.AspNetCore.App.*, Microsoft.WindowsDesktop.App.*) makes the PSES build succeed again, so the extension's suite finally runs. With that, ubuntu-latest and windows-latest are green on #5558.

macos-latest still fails, but before any test starts, because the runner cannot launch the Insiders build it downloaded (Test error: spawn .../Visual Studio Code - Insiders.app/Contents/MacOS/Electron ENOENT) — a separate, pre-existing problem.

Two notes for whoever fixes this properly:

1. Mapping is needed, otherwise NuGet still tries to download the reference packs from the feed that 401s.
2. The job matrix uses the default fail-fast, so one failing platform cancels the other two and hides their results; feat: add WinGet upgrade option to PowerShell update notification (#5477) #5558 sets fail-fast: false in its temporary commit.

[PtJade-Ceramic]

Update: all of this is worked around now, and CI Tests is green on #5558 — the first green run on this repo since 2026-06-25. Two further problems were behind the macOS red, in case they help:

1. NuGet (this issue). Adding nuget.org as a source alone is not enough: NuGet still tries to download the reference packs from the feed that 401s. It needs packageSourceMapping for Microsoft.NETCore.App.*, Microsoft.AspNetCore.App.* and Microsoft.WindowsDesktop.App.* pointing at nuget.org.
2. macOS: VS Code 1.110 renamed the macOS main binary from Contents/MacOS/Electron to the product name (Code - Insiders for Insiders), while @vscode/test-electron 2.x hardcodes the old path, so every macOS run died with spawn ... Electron ENOENT before loading any test. Updating to @vscode/test-electron 3.x fixes it (it resolves the executable from the bundle's Info.plist).
3. The npm side has the same mirror problem. This repo's .npmrc points at the PowerShell Azure Artifacts npm mirror, which has not cached @vscode/test-electron 3.x and returns 401 for packages it has not cached. npm silently skips optional dependencies it cannot fetch, so after the update the install had no vscode-test at all and every platform failed with Can't resolve '@vscode/test-electron'. Serving the @vscode scope (or the whole install) from npmjs until the mirror is refreshed fixes it.
4. The job matrix uses the default fail-fast, so one failing platform cancels the other two and hides their results; fail-fast: false makes all three report.

All four are in #5558 as clearly-marked temporary changes, easy to drop or split into their own PR.