fix: Publish stage always skipped due to condition evaluation issues (#4094)

Two issues in the Publish stage condition:

1. not(${{ parameters.skipNpmPublish }}) mixes compile-time template
   expansion with runtime expression evaluation. The YAML boolean expands
   to 'False'/'True' (capital), which are non-empty strings (always truthy
   in runtime), so not() always returns false. Fix: use ne() string
   comparison instead.

2. stageDependencies.Build.BuildAndPack.outputs['check.hasTarballs'] does
   not resolve correctly under 1ES Pipeline Templates, because
   templateContext.outputs restructures the job and breaks the output
   variable reference path. Fix: remove the cross-stage variable dependency
   and verify tarballs exist inside the Publish job after downloading the
   artifact.

Author: Saadnajmi

.ado/azure-pipelines.publish.yml

@@ -79,18 +79,12 @@ extends:
 
               - script: |
                   ls -la $(System.DefaultWorkingDirectory)/_packed/
-                  if ls $(System.DefaultWorkingDirectory)/_packed/*.tgz > /dev/null 2>&1; then
-                    echo "##vso[task.setvariable variable=hasTarballs;isOutput=true]true"
-                  else
-                    echo "##vso[task.setvariable variable=hasTarballs;isOutput=true]false"
-                  fi
-                name: check
                 displayName: 'List packed tarballs'
 
       - stage: Publish
         displayName: Publish to NPM
         dependsOn: Build
-        condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'), ne('${{ parameters.skipNpmPublish }}', 'true'), eq(stageDependencies.Build.BuildAndPack.outputs['check.hasTarballs'], 'true'))
+        condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'), ne('${{ parameters.skipNpmPublish }}', 'true'))
         jobs:
           - job: PublishPackages
             displayName: Publish NPM Packages
@@ -113,24 +107,33 @@ extends:
               - script: |
                   echo "Downloaded tarballs:"
                   ls -la $(System.DefaultWorkingDirectory)/_packed/
-                displayName: 'List downloaded tarballs'
+                  if ls $(System.DefaultWorkingDirectory)/_packed/*.tgz > /dev/null 2>&1; then
+                    echo "##vso[task.setvariable variable=hasTarballs]true"
+                  else
+                    echo "No tarballs found — nothing to publish."
+                    echo "##vso[task.setvariable variable=hasTarballs]false"
+                  fi
+                displayName: 'Check downloaded tarballs'
 
               - script: |
                   yarn
                 displayName: 'yarn install'
+                condition: eq(variables['hasTarballs'], 'true')
 
               - script: |
                   yarn config set npmPublishAccess public
                   yarn config set npmPublishRegistry "https://registry.npmjs.org"
                   yarn config set npmAuthToken $(npmAuth)
                   npm config set //registry.npmjs.org/:_authToken $(npmAuth)
                 displayName: 'Configure npm publishing auth'
+                condition: eq(variables['hasTarballs'], 'true')
 
               - script: |
                   # https://github.com/changesets/changesets/issues/432
                   # We can't use `changeset publish` because it doesn't support workspaces, so we have to publish each package individually
                   yarn lage publish --verbose --grouped --reporter azureDevops
                 displayName: 'Publish NPM Packages'
+                condition: eq(variables['hasTarballs'], 'true')
 
               - script: |
                   yarn config unset npmPublishAccess