Backport NugetAudit settings

benrr101 · benrr101 · commit d60c4cbae0e7 · 2025-05-01T15:45:50.000-05:00
diff --git a/src/Directory.Build.props b/src/Directory.Build.props
@@ -71,7 +71,17 @@
     <DefineConstants>$(DefineConstants);ENCLAVE_SIMULATOR</DefineConstants>
   </PropertyGroup>
   
-  <!-- Audit Settings -->
+  <!-- NuGet Audit Settings -->
+  <PropertyGroup Condition="'$(TF_BUILD)' == 'true'">
+    <!--
+      ADO does not support audit/vulnerability feeds, so the audit feed is specified (in
+      nuget.config) as nuget.org. OneBranch default network isolation does not allow connections
+      to nuget.org. To avoid this issue, we will disable auditing for official builds, but leave it
+      enabled for local builds.
+      @TODO: If/when auditing is enabled for central feeds services, this can be removed. 
+    -->
+    <NuGetAudit>false</NuGetAudit>
+  </PropertyGroup>
   <PropertyGroup>
     <NuGetAuditMode>all</NuGetAuditMode>
   </PropertyGroup>
