Use ESRP release and private npm registry in publish build (#4192)

Author: ecraig12345

.ado/azure-pipelines.publish.yml

@@ -20,6 +20,20 @@ variables:
   - group: InfoSec-SecurityResults
   - name: tags
     value: production,externalfacing
+  # Use the private registry mirror due to network restrictions (this is added to .npmrc in a step below)
+  - name: REGISTRY_URL
+    value: https://pkgs.dev.azure.com/office/_packaging/Office/npm/registry/
+  - name: YARN_NPM_REGISTRY_SERVER
+    value: $(REGISTRY_URL)
+  - name: YARN_NPM_ALWAYS_AUTH
+    value: 1
+  # Enable yarn-plugin-npmrc
+  - name: YARN_NPMRC_AUTH_ENABLED
+    value: 1
+  - name: packagesArtifactName
+    value: packed-tarballs
+  - name: releaseToolArtifactName
+    value: release-api-tool
 
 resources:
   repositories:
@@ -35,6 +49,8 @@ extends:
       name: Azure-Pipelines-1ESPT-ExDShared
       image: windows-latest
       os: windows
+    settings:
+      networkIsolationPolicy: AzureActiveDirectory,AzureKeyVault,AzureResourceManager,AzureStorage,GitHub
     sdl:
       eslint:
         configuration: 'recommended'
@@ -54,19 +70,36 @@ extends:
               name: Azure-Pipelines-1ESPT-ExDShared
               image: ubuntu-latest
               os: linux
+            variables:
+              # set in lage.config.mjs under BUILD_STAGINGDIRECTORY
+              packagesArtifactPath: $(Build.StagingDirectory)/_packed
+              releaseToolArtifactPath: $(Build.StagingDirectory)/${{ variables.releaseToolArtifactName }}
             templateContext:
+              # run SDL tasks once on this directory for all outputs
+              outputParentDirectory: $(Build.StagingDirectory)
               outputs:
                 - output: pipelineArtifact
-                  targetPath: $(System.DefaultWorkingDirectory)/_packed
-                  artifactName: packed-tarballs
+                  targetPath: $(packagesArtifactPath)
+                  artifactName: ${{ variables.packagesArtifactName }}
+                - output: pipelineArtifact
+                  targetPath: $(releaseToolArtifactPath)
+                  artifactName: ${{ variables.releaseToolArtifactName }}
             steps:
               - task: UseNode@1
                 inputs:
                   version: '22.x'
                 displayName: 'Use Node.js 22.x'
 
+              - script: echo 'registry=$(REGISTRY_URL)' >> .npmrc
+                displayName: 'Configure npm registry'
+
+              - task: npmAuthenticate@0
+                inputs:
+                  workingFile: $(Build.SourcesDirectory)/.npmrc
+                displayName: 'npm authenticate'
+
               - script: |
-                  yarn
+                  yarn --immutable
                 displayName: 'yarn install'
 
               - script: |
@@ -75,75 +108,97 @@ extends:
 
               - script: |
                   yarn lage pack --verbose --grouped
-                displayName: 'Pack all public packages'
+                displayName: 'Pack public packages (new versions only)'
 
               - script: |
-                  ls -la $(System.DefaultWorkingDirectory)/_packed/
+                  ls -laR '$(packagesArtifactPath)'
                 displayName: 'List packed tarballs'
 
+              - script: |
+                  mkdir -p '$(releaseToolArtifactPath)'
+                  cp scripts/esrp-npm-release-temp/index.mjs '$(releaseToolArtifactPath)'
+                displayName: 'Copy ESRP release tool'
+
       - stage: Publish
         displayName: Publish to NPM
         dependsOn: Build
-        condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'), ne('${{ parameters.skipNpmPublish }}', 'true'))
+        # TODO uncomment
+        # condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'), ne('${{ parameters.skipNpmPublish }}', 'true'))
         jobs:
           - job: PublishPackages
             displayName: Publish NPM Packages
             pool:
               name: Azure-Pipelines-1ESPT-ExDShared
               image: ubuntu-latest
               os: linux
+            variables:
+              packagesArtifactPath: $(Agent.BuildDirectory)/${{ variables.packagesArtifactName }}
+              releaseToolArtifactPath: $(Agent.BuildDirectory)/${{ variables.releaseToolArtifactName }}
+            templateContext:
+              type: releaseJob
+              isProduction: true
+              inputs:
+                - input: pipelineArtifact
+                  artifactName: ${{ variables.packagesArtifactName }}
+                  targetPath: $(packagesArtifactPath)
+                - input: pipelineArtifact
+                  artifactName: ${{ variables.releaseToolArtifactName }}
+                  targetPath: $(releaseToolArtifactPath)
             steps:
               - task: UseNode@1
                 inputs:
                   version: '22.x'
                 displayName: 'Use Node.js 22.x'
 
-              - task: DownloadPipelineArtifact@2
-                inputs:
-                  artifactName: packed-tarballs
-                  targetPath: $(System.DefaultWorkingDirectory)/_packed
-                displayName: 'Download packed tarballs'
-
               - script: |
                   echo "Downloaded tarballs:"
-                  ls -la $(System.DefaultWorkingDirectory)/_packed/
-                  if ls $(System.DefaultWorkingDirectory)/_packed/*.tgz > /dev/null 2>&1; then
-                    echo "##vso[task.setvariable variable=hasTarballs]true"
+                  ls -laR '$(packagesArtifactPath)'
+                  if ls "$(packagesArtifactPath)/*/*.tgz" > /dev/null 2>&1; then
+                    echo "##vso[task.setvariable variable=hasTarballs]yes"
                   else
                     echo "No tarballs found — nothing to publish."
-                    echo "##vso[task.setvariable variable=hasTarballs]false"
+                    echo "##vso[task.setvariable variable=hasTarballs]no"
                   fi
                 displayName: 'Check downloaded tarballs'
 
-              - script: |
-                  yarn
-                displayName: 'yarn install'
-                condition: eq(variables['hasTarballs'], 'true')
-
-              - script: |
-                  yarn config set npmPublishAccess public
-                  yarn config set npmPublishRegistry "https://registry.npmjs.org"
-                  yarn config set npmAuthToken $(npmAuth)
-                  npm config set //registry.npmjs.org/:_authToken $(npmAuth)
-                displayName: 'Configure npm publishing auth'
-                condition: eq(variables['hasTarballs'], 'true')
-
-              - script: |
-                  # https://github.com/changesets/changesets/issues/432
-                  # We can't use `changeset publish` because it doesn't support workspaces, so we have to publish each package individually
-                  yarn lage publish --verbose --grouped --reporter azureDevops
-                displayName: 'Publish NPM Packages'
-                condition: eq(variables['hasTarballs'], 'true')
-
-              - script: |
-                  yarn config unset npmPublishAccess
-                  yarn config unset npmAuthToken
-                  yarn config unset npmPublishRegistry
-                  npm config delete //registry.npmjs.org/:_authToken
-                displayName: 'Cleanup npm publishing auth'
-                condition: always()
-
-              - script: |
-                  git clean -dfx
-                displayName: 'Clean up working directory'
-                condition: always()
+              - task: AzureCLI@2
+                displayName: 'Get credentials for staging blob storage'
+                condition: eq(variables['hasTarballs'], 'yes')
+                inputs:
+                  azureSubscription: ogx-esrp-infra-bot
+                  scriptType: bash
+                  scriptLocation: inlineScript
+                  addSpnToEnvironment: true
+                  inlineScript: |
+                    echo "##vso[task.setvariable variable=STAGING_TENANT_ID]$tenantId"
+                    echo "##vso[task.setvariable variable=STAGING_CLIENT_ID]$servicePrincipalId"
+                    echo "##vso[task.setvariable variable=STAGING_ID_TOKEN;issecret=true]$idToken"
+
+              - task: AzureKeyVault@2
+                displayName: 'Get ESRP certificates from Key Vault'
+                condition: eq(variables['hasTarballs'], 'yes')
+                inputs:
+                  azureSubscription: ESRP-JSHost3
+                  KeyVaultName: OGX-JSHost-KV
+                  SecretsFilter: OGX-JSHost-Auth4,OGX-JSHost-Sign3
+
+              # TODO uncomment
+              # - script: node '$(releaseToolArtifactPath)/index.mjs'
+              #   displayName: 'Publish packages using ESRP Release API'
+              #   condition: eq(variables['hasTarballs'], 'yes')
+              #   retryCountOnTaskFailure: 3
+              #   env:
+              #     PACKED_PACKAGES_PATH: $(packagesArtifactPath)
+              #     ESRP_PRODUCT_NAME: fluentui-react-native
+              #     ESRP_NPM_TAG: latest
+              #     # TODO should be somebody else
+              #     ESRP_USER: elcraig@microsoft.com
+              #     ESRP_APPROVERS: dannyvv@microsoft.com
+              #     ESRP_TENANT_ID: cdc5aeea-15c5-4db6-b079-fcadd2505dc2
+              #     ESRP_CLIENT_ID: 0a35e01f-eadf-420a-a2bf-def002ba898d
+              #     ESRP_AUTH_CERT: $(OGX-JSHost-Auth4)
+              #     ESRP_REQUEST_SIGNING_CERT: $(OGX-JSHost-Sign3)
+              #     STAGING_STORAGE_ACCOUNT_NAME: ogxesrptempstorage
+              #     STAGING_CLIENT_ID: $(STAGING_CLIENT_ID)
+              #     STAGING_TENANT_ID: $(STAGING_TENANT_ID)
+              #     STAGING_ID_TOKEN: $(STAGING_ID_TOKEN)

.changeset/two-buttons-joke.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/dependency-profiles': patch
+---
+
+Update `workspace-tools` to `^0.42.0`

.github/workflows/pr.yml

@@ -334,8 +334,8 @@ jobs:
       - name: List packed tarballs
         id: check
         run: |
-          ls -la _packed/
-          if ls _packed/*.tgz > /dev/null 2>&1; then
+          ls -laR _packed/
+          if ls _packed/*/*.tgz > /dev/null 2>&1; then
             echo "has-tarballs=true" >> $GITHUB_OUTPUT
           else
             echo "has-tarballs=false" >> $GITHUB_OUTPUT
@@ -348,33 +348,6 @@ jobs:
           name: packed-tarballs-dry-run
           path: _packed/
 
-  publish-dry-run:
-    name: NPM Publish Dry Run — Publish
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    needs: publish-dry-run-pack
-    if: needs.publish-dry-run-pack.outputs.has-tarballs == 'true'
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set up toolchain
-        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@5.2.3
-        with:
-          node-version: 22
-
-      - name: Install dependencies
-        run: yarn
-
-      - name: Download packed tarballs
-        uses: actions/download-artifact@v8
-        with:
-          name: packed-tarballs-dry-run
-          path: _packed/
-
-      - name: Simulate publish
-        run: yarn lage publish:dry-run --verbose --grouped
-
   test-links:
     name: Test repo links
     runs-on: ubuntu-latest
@@ -407,7 +380,6 @@ jobs:
       - win32
       - check-changesets
       - publish-dry-run-pack
-      - publish-dry-run
       - test-links
     steps:
       - name: Check for failures or cancellations

.gitignore

@@ -117,6 +117,9 @@ apps/*/.vscode/.react/
 !**/.yarn/sdks
 !**/.yarn/versions
 
+# May contain credentials
+.npmrc
+
 # Ccache
 .ccache
 

.oxfmtrc.json

@@ -11,6 +11,7 @@
     "**/lib-commonjs/**",
     "**/dist/**",
     "packages/components/Callout/windows/FRNCallout/codegen/**",
+    "**/esrp-npm-release-temp/**",
     "**/CHANGELOG.*",
     "**/CODE_OF_CONDUCT.md",
     "**/SECURITY.md",

.vscode/settings.json

@@ -40,20 +40,19 @@
     "**/lib-amd": true
   },
 
-  "javascript.preferences.quoteStyle": "single",
-
   "json.format.enable": false,
 
-  "typescript.preferences.quoteStyle": "single",
-  "typescript.format.insertSpaceAfterOpeningAndBeforeClosingJsxExpressionBraces": false,
-  "typescript.format.insertSpaceAfterOpeningAndBeforeClosingNonemptyParenthesis": false,
+  "js/ts.preferences.quoteStyle": "single",
+  "js/ts.format.insertSpaceAfterOpeningAndBeforeClosingJsxExpressionBraces": false,
+  "js/ts.format.insertSpaceAfterOpeningAndBeforeClosingNonemptyParenthesis": false,
   // Points at the workspace's typescript package (7.0.2, native tsc). The
   // TypeScript 7 (native-preview) extension detects that this tsdk has no
   // tsserver.js and automatically runs it as a native LSP server.
-  "typescript.tsdk": "./node_modules/typescript/lib",
+  "js/ts.tsdk.path": "./node_modules/typescript/lib",
 
   "search.exclude": {
     "**/node_modules": true,
+    "**/.yarn": true,
     "**/lib": true,
     "**/lib-amd": true,
     "**/lib-commonjs": true,