Document the internal NuGet feed needed to run tests on a corp machine

[Alexandre Zollinger Chohfi (azchohfi)]

Problem

api.nuget.org is unreachable from Microsoft corporate machines, so any test that downloads Microsoft.Windows.SDK.BuildTools — most of the PackageCommand, SignCommand and MsixService coverage — fails with:

Failed to install Microsoft.Windows.SDK.BuildTools: The SSL connection could not be established

That is indistinguishable from a transient network fault, and nothing in AGENTS.md said otherwise. The natural conclusion is "flaky, re-run it" or "environmental, let CI decide" — both wrong, and both waste real time. I hit this exact trap on #745: I saw the SSL error, probed api.nuget.org to confirm it was unreachable, and reported the failures as environmental. The probe confirmed my hypothesis instead of testing it, and I never asked the question that would have settled it in one grep — how does CI run these same tests successfully?

Change

Documentation only. A new section under Developer workflows covering:

• That this is a known limitation, not a flaky test — with an explicit "do not re-run hoping it passes".
• The three WINAPP_NUGET_* values, matching what .pipelines/templates/build.yaml already sets in CI.
• The VSS_NUGET_ACCESSTOKEN step, and the detail that auth is Basic VssSessionToken:<token> applied only to URLs under the auth prefix.
• A one-line probe to confirm the feed answers before committing to a multi-minute run.
• The general rule this is an instance of: if it fails locally but passes in CI, the difference is configuration, not luck.

The capability already existed — NugetService falls back to api.nuget.org only when these are unset. It was simply never written down for anyone working outside CI.

Verification

Followed the documented steps from a clean shell, then re-ran the two tests that had failed:

CreateMsixPackageAsync_WithExternalManifestAndMismatchedCertificate_ShouldFail
CreateMsixPackageAsync_AutoSignWithGenerateDevCert_GeneratesAndSignsWithDevCertificate

Test run summary: Passed!
  total: 2, failed: 0, succeeded: 2

The probe command is also verified — it returns 379 versions of Microsoft.Windows.SDK.BuildTools.

Note

AGENTS.md is the only instruction file in the repo (no CONTRIBUTING.md, copilot-instructions.md or CLAUDE.md), so this is the single place it needs to live.

[Copilot]

Pull request overview

Documents the internal NuGet feed configuration required to run package-dependent tests on Microsoft corporate machines.

Changes:

• Adds feed environment variables, authentication setup, and connectivity probe.
• Clarifies that NuGet failures require matching CI configuration rather than retries.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.