azure-pipelines.yaml: Cannot authenticate organization scoped feed

Question

I'm having a .npmrc file:

registry=https://XXX.pkgs.visualstudio.com/_packaging/YYY/npm/registry/
always-auth=true

And my azure-pipelines.yaml:

trigger:
- master

pool:
  vmImage: 'ubuntu-latest'

steps:
- task: NodeTool@0
  inputs:
    versionSpec: '10.x'
  displayName: 'Install Node.js'

- task: Npm@1
  inputs:
    command: 'install'
  displayName: 'npm install'

My feed has 'Project Collection Build Service' as 'Contributor'.

However I keep getting this:

/opt/hostedtoolcache/node/10.19.0/x64/bin/npm install
npm ERR! code E403
npm ERR! 403 403 Forbidden - GET https://XXX.pkgs.visualstudio.com/_packaging/YYY/npm/registry/ansi-regex - Forbidden
npm ERR! 403 In most cases, you or one of your dependencies are requesting
npm ERR! 403 a package version that is forbidden by your security policy.
npm ERR! 403 
npm ERR! 403 It was specified as a dependency of 's'
npm ERR! 403 

Answer 1

My feed has 'Project Collection Build Service' as 'Contributor'.

As normal, this is not a general solution, it only available while the service account that the pipeline used is Project Collection Build Service. Project Collection Build Service is a organization-level build service account

I'm afraid your pipeline here is using project-level build service account.

---

Here has 2 method you can consider to use.

Method 1:

Please go Feed settings => Permissions, add your project-level build service account and assign it Contributor role. Its account name should like {Project Name} Build Service ({Org Name}).

Re-run your pipeline to see whether it can run successfully.

Method 2:

Go Project settings => Settings, and make sure Limit job authorization scope to current project is disabled:

Only it disabled, the service account that pipeline used is collection-level one. At this time, your original permission configuration would be available now.

---

At last, which is not what I expected, is you are facing our event. Not sure, but hoping you are just facing permission issue.