Release updates + remove unnecessary yarn resolutions (#4195)

Author: ecraig12345

.ado/azure-pipelines.publish.yml

@@ -18,22 +18,29 @@ parameters:
 variables:
   - group: 'FluentUI React Native Secrets'
   - group: InfoSec-SecurityResults
-  - name: tags
-    value: production,externalfacing
-  # Use the private registry mirror due to network restrictions (this is added to .npmrc in a step below)
-  - name: REGISTRY_URL
-    value: https://pkgs.dev.azure.com/office/_packaging/Office/npm/registry/
-  - name: YARN_NPM_REGISTRY_SERVER
-    value: $(REGISTRY_URL)
-  - name: YARN_NPM_ALWAYS_AUTH
-    value: 1
-  # Enable yarn-plugin-npmrc
-  - name: YARN_NPMRC_AUTH_ENABLED
-    value: 1
-  - name: packagesArtifactName
-    value: packed-tarballs
-  - name: releaseToolArtifactName
-    value: release-api-tool
+  - group: ogx-oss-release
+  - template: .ado/templates/readonly-variables.yml
+    parameters:
+      variables:
+        tags: production,externalfacing
+
+        # Use the private registry mirror due to network restrictions (this is added to .npmrc in a step below)
+        REGISTRY_URL: https://pkgs.dev.azure.com/office/_packaging/Office/npm/registry/
+        YARN_NPM_REGISTRY_SERVER: $(REGISTRY_URL)
+        YARN_NPM_ALWAYS_AUTH: 1
+        # Enable yarn-plugin-npmrc
+        YARN_NPMRC_AUTH_ENABLED: 1
+
+        packagesArtifactName: packed-tarballs
+        releaseToolArtifactName: release-api-tool
+
+        # Map in variable group values as readonly (with this syntax, they'll be empty strings if unset)
+        esrpStagingAzureSubscription: $[variables.grp_esrpStagingAzureSubscription]
+        esrpStagingStorageAccount: $[variables.grp_esrpStagingStorageAccount]
+        esrpReleaseAzureSubscription: $[variables.grp_esrpReleaseAzureSubscription]
+        esrpReleaseClientId: $[variables.grp_esrpReleaseClientId]
+        esrpReleaseKeyVaultName: $[variables.grp_esrpReleaseKeyVaultName]
+        esrpReleaseTenantId: $[variables.grp_esrpReleaseTenantId]
 
 resources:
   repositories:
@@ -116,7 +123,7 @@ extends:
 
               - script: |
                   mkdir -p '$(releaseToolArtifactPath)'
-                  cp scripts/esrp-npm-release-temp/index.mjs '$(releaseToolArtifactPath)'
+                  cp node_modules/@microsoft/esrp-npm-release/index.mjs '$(releaseToolArtifactPath)'
                 displayName: 'Copy ESRP release tool'
 
       - stage: Publish
@@ -157,7 +164,7 @@ extends:
               - task: AzureCLI@2
                 displayName: 'Get credentials for staging blob storage'
                 inputs:
-                  azureSubscription: ogx-esrp-infra-bot
+                  azureSubscription: $(esrpStagingAzureSubscription)
                   scriptType: bash
                   scriptLocation: inlineScript
                   addSpnToEnvironment: true
@@ -169,8 +176,8 @@ extends:
               - task: AzureKeyVault@2
                 displayName: 'Get ESRP certificates from Key Vault'
                 inputs:
-                  azureSubscription: ESRP-JSHost3
-                  KeyVaultName: OGX-JSHost-KV
+                  azureSubscription: $(esrpReleaseAzureSubscription)
+                  KeyVaultName: $(esrpReleaseKeyVaultName)
                   SecretsFilter: OGX-JSHost-Auth4,OGX-JSHost-Sign3
 
               - script: node '$(releaseToolArtifactPath)/index.mjs'
@@ -180,14 +187,13 @@ extends:
                   PACKED_PACKAGES_PATH: $(packagesArtifactPath)
                   ESRP_PRODUCT_NAME: fluentui-react-native
                   ESRP_NPM_TAG: latest
-                  # TODO should be somebody else
-                  ESRP_USER: elcraig@microsoft.com
-                  ESRP_APPROVERS: dannyvv@microsoft.com
+                  ESRP_USER: sanajmi@microsoft.com
+                  ESRP_APPROVERS: jasonmo@microsoft.com
                   ESRP_TENANT_ID: cdc5aeea-15c5-4db6-b079-fcadd2505dc2
                   ESRP_CLIENT_ID: 0a35e01f-eadf-420a-a2bf-def002ba898d
                   ESRP_AUTH_CERT: $(OGX-JSHost-Auth4)
                   ESRP_REQUEST_SIGNING_CERT: $(OGX-JSHost-Sign3)
-                  STAGING_STORAGE_ACCOUNT_NAME: ogxesrptempstorage
+                  STAGING_STORAGE_ACCOUNT_NAME: $(esrpStagingStorageAccount)
                   STAGING_CLIENT_ID: $(STAGING_CLIENT_ID)
                   STAGING_TENANT_ID: $(STAGING_TENANT_ID)
                   STAGING_ID_TOKEN: $(STAGING_ID_TOKEN)

.ado/templates/readonly-variables.yml

@@ -0,0 +1,11 @@
+# This template is a helper to declare many readonly variables in a readable manner.
+parameters:
+  - name: variables
+    type: object
+    default: {}
+
+variables:
+  - ${{ each variable in parameters.variables }}:
+      - name: ${{ variable.key }}
+        value: ${{ variable.value }}
+        readonly: true

.oxfmtrc.json

@@ -11,7 +11,6 @@
     "**/lib-commonjs/**",
     "**/dist/**",
     "packages/native/Callout/windows/Callout/codegen/**",
-    "**/esrp-npm-release-temp/**",
     "**/CHANGELOG.*",
     "**/CODE_OF_CONDUCT.md",
     "**/SECURITY.md",

.yarnrc.yml

@@ -341,4 +341,6 @@ plugins:
     path: .yarn/plugins/@yarnpkg/plugin-npmrc.cjs
     spec: "https://raw.githubusercontent.com/microsoft/beachball/yarn-plugin-npmrc_v0.5.1/yarn-plugins/npmrc/dist/plugin.js"
 
+preferReuse: true
+
 yarnPath: .yarn/releases/yarn-4.18.0.cjs

package.json

@@ -44,6 +44,7 @@
     "@babel/runtime": "catalog:",
     "@changesets/changelog-github": "^0.5.0",
     "@changesets/cli": "^2.30.0",
+    "@microsoft/esrp-npm-release": "^0.1.2",
     "@rnx-kit/align-deps": "catalog:",
     "@rnx-kit/lint-lockfile": "catalog:",
     "@yarnpkg/types": "^4.0.1",
@@ -62,27 +63,15 @@
     "@fluentui/react-native-icons/@types/react-native": "ignore:",
     "@react-native-windows/cli": "patch:@react-native-windows/cli@npm%3A0.81.8#~/.yarn/patches/@react-native-windows-cli-npm-0.81.8-9ffb7042e8.patch",
     "@types/react": "19.1.17",
-    "@xmldom/xmldom@npm:^0.8.8": "0.8.13",
-    "@xmldom/xmldom@npm:^0.9.5": "0.9.10",
-    "@xmldom/xmldom@npm:^0.x": "0.9.10",
-    "axios": "^1.18.1",
-    "esbuild@npm:~0.25.0": "0.25.12",
+    "axios@npm:1.13.3": "^1.18.1",
+    "esbuild@npm:~0.25.0": "^0.28.0",
     "expect-webdriverio": "patch:expect-webdriverio@npm%3A5.6.1#~/.yarn/patches/expect-webdriverio-npm-5.6.1-69666d39e9.patch",
-    "form-data": "4.0.6",
-    "lodash": "4.18.1",
-    "path-to-regexp": "8.4.2",
-    "picomatch@npm:^2.0.4": "2.3.2",
-    "picomatch@npm:^2.2.1": "2.3.2",
-    "picomatch@npm:^2.2.3": "2.3.2",
-    "picomatch@npm:^2.3.1": "2.3.2",
-    "shell-quote": "1.9.0",
-    "tmp": "0.2.7",
-    "undici@npm:^6.21.3": "6.27.0",
-    "unicorn-magic": "^0.4.0",
-    "ws@npm:8.19.0": "8.21.0",
-    "ws@npm:^6.2.3": "6.2.4",
-    "ws@npm:^7": "7.5.11",
-    "ws@npm:^7.5.10": "7.5.11"
+    "form-data@npm:4.0.5": "^4.0.6",
+    "lodash": "^4.18.1",
+    "path-to-regexp@npm:8.3.0": "^8.4.2",
+    "shell-quote": "^1.9.0",
+    "unicorn-magic@npm:^0.3.0": "^0.4.0",
+    "ws@npm:8.19.0": "^8.21.0"
   },
   "engines": {
     "node": ">=22.12"