[release/13.5] Stabilize Azure Functions Core Tools install in CI

[aspire-repo-bot]

Backport of #19175 to release/13.5

/cc Mitch Denny (@mitchdenny) Adam Ratzman (@adamint)

Customer Impact

The shared Playground CI leg cannot install Azure Functions Core Tools because the floating npm @4 package resolves to 4.13.2, whose Linux x64 CDN payload returns HTTP 404. This makes otherwise-unrelated release/13.5 PRs fail their required CI validation.

Testing

The source PR passed all 353 executed CI checks. Local Linux x64 validation downloaded the pinned 4.12.1 GitHub release, verified its SHA-256 checksum, and confirmed func --version reports 4.12.1. An Infrastructure regression test verifies the workflow remains pinned to the checksummed release path.

Risk

Low. The change is limited to the Linux Azure Functions Core Tools setup used by the Playground/Azure test workflow, reuses the installation pattern already used by extension E2E tests, and does not change shipped product code.

Regression?

No — this is an external upstream npm/CDN publication failure rather than a regression in Aspire.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19186

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19186"

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates CI to install Azure Functions Core Tools from a pinned GitHub release (with checksum verification) instead of the npm package, and adds a test to lock in this workflow behavior.

Changes:

• Replace npm i -g azure-functions-core-tools@4 in run-tests.yml with a pinned GitHub release download + SHA256 verification.
• Add a unit test asserting the workflow uses the pinned release URL, checksum verification, and version check.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
tests/Infrastructure.Tests/Pipelines/NpmCliPackageTests.cs	Adds a regression test to ensure CI uses the pinned Core Tools GitHub release path.
.github/workflows/run-tests.yml	Switches Core Tools installation to a pinned zip download with SHA256 verification.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Mitch Denny (mitchdenny)]

Approved for release/13.5. This is a focused CI-only backport that replaces the broken floating Core Tools CDN install with the pinned, checksummed release path validated on main.

[github-actions]

Tests selector (audit mode)

The full test matrix and all jobs still run in audit mode. The tests and jobs below are what selective CI would run under enforcement.

Runs the full test matrix + all jobs (ALL) — a rule matching '.github/workflows/run-tests.yml' selects ALL

---

Selection computed for commit a8c0514.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[aspire-repo-bot]

✅ No documentation update needed.

Step 5 branch taken: excluded → backport (multiple markers).

Exclusion reasons from signals.json: base_branch_is_release, head_branch_is_backport, title_release_prefix, body_backport_marker — this PR's title is prefixed [release/13.5], its body states "Backport of #19175 to release/13.5", its head branch is a backport branch, and its base is a release branch.

Triggered signals: pr_body_has_cli_flag_mention (1) — matched on the phrase "func --version" in the PR body testing notes, not an actual CLI flag addition.

Per workflow rules, excluded == true overrides recommendation (docs_optional) entirely. This PR only ports an internal CI/test stabilization fix (pinning Azure Functions Core Tools npm install version in .github/workflows/run-tests.yml and a matching infra regression test) from the original PR #19175 on the default branch. No user-facing product behavior changed, and any documentation implications belong to the original forward PR, not this backport. No docs PR drafted.