GeezerVison

Backport of #28356 to release/v7.6.10

Triggered by Dongbo Wang (@daxian-dbw) on behalf of Aditya Patwardhan (@adityapatwardhan)

Original CL Label: CL-BuildPackaging

/cc @PowerShell/powershell-maintainers

Impact

REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.

Tooling Impact

• Required tooling change
• Optional tooling change (include reasoning)

Fixes authenticated bundled-module restores in vPack and MSIX builds when UseEarlyAccessModules is enabled without IsEarlyAccess. Both build steps explicitly map the secret VSS_NUGET_EXTERNAL_FEED_ENDPOINTS variable into their environment, since Azure Pipelines does not automatically export secret variables.

Customer Impact

• Customer reported
• Found internally

Regression

REQUIRED: Check exactly one box.

• Yes
• No

Fixes credential mapping omitted when the internal module-feed feature from #28326 was backported to release/v7.6.10 via #28355.

Testing

Includes the original PR's regression coverage requiring direct secret credential mappings in both build-step environment blocks. Independent review confirmed the intended mappings, preservation of release runtime-key behavior, documentation and regression additions, no remaining YAML conflict markers, and a passing git diff --check HEAD. Local YAML parsing was skipped at the user's request; local Pester tests were not run. Cherry-pick completed as 3a91ff5 and the worktree is clean. Backport CI, including Azure Pipelines authentication validation, must pass before merge.

Risk

REQUIRED: Check exactly one box.

• High
• Medium
• Low

Changes shared build pipeline authentication, but the fix is limited to explicit environment mappings for the existing secret variable. Release-specific runtime-key behavior is unchanged, and regression tests cover both mappings. CI validation is required before merge.

Merge Conflicts

Resolved conflicts in .pipelines/MSIXBundle-vPack-Official.yml and .pipelines/templates/stages/PowerShell-vPack-Stages.yml. In both files, added a direct VSS_NUGET_EXTERNAL_FEED_ENDPOINTS environment mapping to the Build Windows Universal step. Preserved the release vPack template's existing unconditional __DOTNET_RUNTIME_FEED_KEY mapping. The release MSIX pipeline has no IsEarlyAccess parameter or runtime-feed-key mapping, so did not import master's unrelated conditional runtime-key block. Documentation and regression tests applied without conflicts.