GeezerVison

Backport of #28356 to release/v7.7.0

Triggered by Justin Chung (@jshigetomi) on behalf of Aditya Patwardhan (@adityapatwardhan)

Original CL Label: CL-BuildPackaging

/cc @PowerShell/powershell-maintainers

Impact

Tooling Impact

• Required tooling change
• Optional tooling change (include reasoning)

Fixes authenticated bundled-module restores in vPack and MSIX builds when UseEarlyAccessModules is enabled without IsEarlyAccess. Both build steps explicitly map the secret VSS_NUGET_EXTERNAL_FEED_ENDPOINTS variable into their environment, since Azure Pipelines does not automatically export secret variables.

Customer Impact

• Customer reported
• Found internally

Regression

• Yes
• No

Fixes credential mapping omitted when the internal module-feed feature from #28326 was backported to release/v7.7.0 via merged prerequisite #28366.

Testing

Includes the original PR's regression coverage requiring direct secret credential mappings in both build-step environment blocks. The clean cherry-pick applied without conflicts. The original PR validated both pipeline YAML files across all four early-access flag combinations, preserved existing runtime-feed-key behavior and secret publication, passed PowerShell syntax parsing and git diff --check, and verified the new regression-test regexes against fixed and original files. Local Pester could not run because Pester and PowerShell Gallery access were unavailable. Backport CI, including Azure Pipelines authentication validation, must pass before merge.

Risk

• High
• Medium
• Low

Changes shared build pipeline authentication, but the fix is limited to explicit environment mappings for the existing secret variable. Runtime-feed-key behavior is unchanged, and regression tests cover both mappings. CI validation is required before merge.