Compliance issue for [SFI-ES5.1] Azure Artifacts - Central Feed Services (CFS)

Hi Team,

I integrated this tool into our repo build pipeline, but encountered a compliance issue [SFI-ES5.1] related to Azure Artifacts - Central Feed Services (CFS). The requirement is that builds must pull open-source libraries from an [Azure Artifacts] feed. To resolve this, I tried using configuration options similar to those provided by other Azure DevOps tasks, providing the params like feedsToUse and nugetConfigPath, such as:

- task: MicrosoftSecurityDevOps@1
  displayName: 'Run Template Analyzer'
  inputs:    
    tools: 'templateanalyzer'
    break: false
    feedsToUse: config
    nugetConfigPath: 'nuget.config'

However, this didn't work as expected. The logs show that MSDO is still retrieving the feed from the public source:

Installing Microsoft.Security.DevOps.Tools.Configuration from feed...
  ------------------------------------------------------------------------------
      GET https://msdous.pkgs.visualstudio.com/d1ee6cdc-c4ce-4e34-95df-4c038f0d3683/_packaging/7c44b921-ee7b-48f1-bad3-d9227399a9fc/nuget/v3/registrations2-semver2/microsoft.security.devops.tools.configuration/index.json
      OK https://msdous.pkgs.visualstudio.com/d1ee6cdc-c4ce-4e34-95df-4c038f0d3683/_packaging/7c44b921-ee7b-48f1-bad3-d9227399a9fc/nuget/v3/registrations2-semver2/microsoft.security.devops.tools.configuration/index.json 84ms

Should we consider supporting a feed suppression feature to help meet security compliance requirements?

Thanks,
Best regards,

Inizia dal punto di ingresso dell'attività MicrosoftSecurityDevOps@1 e segui il modo in cui lo strumento templateanalyzer installa Microsoft.Security.DevOps.Tools.Configuration. Esamina come vengono gestiti feedsToUse, nugetConfigPath e nuget.config, quindi confronta l'origine del pacchetto con il feed pubblico registrato. Il lavoro è completo quando il recupero del pacchetto può usare il feed Azure Artifacts configurato e sopprimere l'origine pubblica.