Merge branch 'main' into circulardependencyCheck

Author: vineethkuttan

.ado/jobs/desktop.yml

@@ -325,17 +325,9 @@ jobs:
 
               - template: ../templates/stop-packagers.yml
 
-            - task: BinSkim@4
-              displayName: Run Binskim Analysis
+            - script: node .ado/scripts/build.js --binskim --platform ${{ matrix.BuildPlatform }} --configuration ${{ matrix.BuildConfiguration }} --target desktop
+              displayName: Run BinSkim Analysis
               condition: eq('${{ matrix.BuildConfiguration }}', 'Release')
-              inputs:
-                  InputType: 'Basic'
-                  Function: 'analyze'
-                  TargetPattern: 'guardianGlob'
-                  AnalyzeTargetGlob: '$(Build.SourcesDirectory)\vnext\target\${{ matrix.BuildPlatform }}\${{ matrix.BuildConfiguration }}\React.Windows.Desktop.DLL\react-native-win32.dll'
-                  AnalyzeVerbose: true
-                  toolVersion: 'Latest'
-              continueOnError: true
 
             - template: ../templates/publish-build-artifacts.yml
               parameters:

.ado/jobs/universal.yml

@@ -177,16 +177,9 @@
                     targetPath: $(Build.SourcesDirectory)/vnext/target/${{ matrix.BuildPlatform }}/${{ matrix.BuildConfiguration }}
                     artifactName: ReactWindows.${{ matrix.BuildPlatform }}.${{ matrix.BuildConfiguration }}
 
-                - task: BinSkim@4
-                  displayName: Run Binskim Analysis
+                - script: node .ado/scripts/build.js --binskim --platform ${{ matrix.BuildPlatform }} --configuration ${{ matrix.BuildConfiguration }} --target universal
+                  displayName: Run BinSkim Analysis
                   condition: and(succeeded(), eq('${{ matrix.BuildConfiguration }}', 'Release'), ne('${{ matrix.BuildPlatform }}', 'ARM64'))
-                  inputs:
-                      InputType: 'Basic'
-                      Function: 'analyze'
-                      TargetPattern: 'guardianGlob'
-                      AnalyzeTargetGlob: '$(Build.SourcesDirectory)\vnext\target\${{ matrix.BuildPlatform }}\${{ matrix.BuildConfiguration }}\Microsoft.ReactNative\Microsoft.ReactNative.dll'
-                      AnalyzeVerbose: true
-                      toolVersion: 'LatestPreRelease'
 
                 - template: ../templates/discover-google-test-adapter.yml
 

.ado/publish.yml

@@ -65,7 +65,7 @@ variables:
   - name: FailCGOnAlert
     value: false
   - name: EnableCodesign
-    value: false
+    value: true
 
 trigger: none
 pr: none
@@ -145,6 +145,9 @@ extends:
           - script: echo NpmDistTag is $(NpmDistTag)
             displayName: Show NPM dist tag
 
+          - script: copy ".ado\scripts\npmPack.js" "$(Build.StagingDirectory)\versionEnvVars\npmPack.js"
+            displayName: Include npmPack.js in VersionEnvVars artifact
+
           - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
             displayName: 📒 Generate Manifest Npm
             inputs:
@@ -351,9 +354,12 @@ extends:
                   configuration: Debug
 
           # Symbol Publishing for Work Item 59264834 - MSRC Compliance
+          # continueOnError: Duplicate symbols are expected when the pipeline
+          # is re-run for the same version. The symbols already exist on the
+          # server, so it is safe to continue.
           - task: PublishSymbols@2
             displayName: 'Publish Symbols to Microsoft Symbol Server'
-            enabled: true
+            continueOnError: true
             inputs:
               UseNetCoreClientTool: true
               ConnectedServiceName: Office-React-Native-Windows-Bot
@@ -362,7 +368,7 @@ extends:
               SymbolServerType: 'TeamServices'
               SymbolsProduct: 'ReactNativeWindows'
               SymbolsVersion: '$(Build.BuildNumber)'
-              SymbolsArtifactName: 'ReactNativeWindows-Symbols'
+              SymbolsArtifactName: 'ReactNativeWindows-Symbols-$(Build.BuildId)'
               DetailedLog: true
               TreatNotIndexedAsWarning: false
 

.ado/release.yml

@@ -1,6 +1,18 @@
+#
+# The Release pipeline entry point.
+# It releases npm packages to npmjs.com and NuGet packages to the public
+# ms/react-native and ms/react-native-public ADO feeds and to nuget.org.
+#
+# The pipeline completion trigger is defined below in the pipeline resource.
+# Do NOT add a build completion trigger in the ADO UI — UI triggers override
+# YAML triggers and cause the pipeline to always run against the default branch
+# with incorrect metadata (wrong commit message and branch).
+#
+
 name: RNW NuGet Release $(Date:yyyyMMdd).$(Rev:r)
 
 trigger: none
+pr: none
 
 resources:
   pipelines:
@@ -10,12 +22,16 @@ resources:
     trigger:
       branches:
         include:
-        - -1espublish
+        - main
+        - refs/heads/main
+        - '*-stable'
+        - 'refs/heads/*-stable'
   repositories:
   - repository: 1ESPipelineTemplates
     type: git
     name: 1ESPipelineTemplates/1ESPipelineTemplates
     ref: refs/tags/release
+
 extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
   parameters:
@@ -28,13 +44,18 @@ extends:
     stages:
     - stage: Release
       displayName: Publish artifacts
+      # Allow manual runs unconditionally; for build-completion triggers,
+      # only proceed if the commit message starts with 'RELEASE:'.
+      condition: or(eq(variables['Build.Reason'], 'Manual'), startsWith(variables['Build.SourceVersionMessage'], 'RELEASE:'))
       jobs:
       - job: PushNpm
         displayName: npmjs.com - Publish npm packages
         variables:
         - group: RNW Secrets
-        timeoutInMinutes: 0
+        timeoutInMinutes: 30
         templateContext:
+          type: releaseJob
+          isProduction: true
           inputs:
           - input: pipelineArtifact
             pipeline: 'Publish'
@@ -45,15 +66,13 @@ extends:
             artifactName: 'VersionEnvVars'
             targetPath: '$(Pipeline.Workspace)/VersionEnvVars'
         steps:
-        - checkout: self
-          clean: false
         - task: CmdLine@2
           displayName: Apply version variables
           inputs:
             script: node $(Pipeline.Workspace)/VersionEnvVars/versionEnvVars.js
         - script: dir /s "$(Pipeline.Workspace)\published-packages"
           displayName: Show npm packages before cleanup
-        - script: node .ado/scripts/npmPack.js --no-pack --check-npm --no-color "$(Pipeline.Workspace)\published-packages"
+        - script: node "$(Pipeline.Workspace)\VersionEnvVars\npmPack.js" --no-pack --check-npm --no-color "$(Pipeline.Workspace)\published-packages"
           displayName: Remove already published packages
         - script: dir /s "$(Pipeline.Workspace)\published-packages"
           displayName: Show npm packages after cleanup
@@ -82,112 +101,69 @@ extends:
 
       - job: PushPrivateAdo
         displayName: ADO - nuget - react-native
-
+        timeoutInMinutes: 30
         templateContext:
+          type: releaseJob
+          isProduction: true
           inputs:
           - input: pipelineArtifact
             pipeline: 'Publish'
             artifactName: 'ReactWindows-final-nuget'
             targetPath: '$(Pipeline.Workspace)/ReactWindows-final-nuget'
-        
         steps:
-        - checkout: none
-
-        - script: dir /S $(Pipeline.Workspace)\ReactWindows-final-nuget
-          displayName: Show directory contents
-
-        - task: AzureCLI@2
-          displayName: Override NuGet credentials with Managed Identity
-          inputs:
-            azureSubscription: 'Office-React-Native-Windows-Bot'
-            visibleAzLogin: false
-            scriptType: 'pscore'
-            scriptLocation: 'inlineScript'
-            inlineScript: |
-              $accessToken = az account get-access-token --query accessToken --resource 499b84ac-1321-427f-aa17-267ca6975798 -o tsv
-              # Set the access token as a secret, so it doesn't get leaked in the logs
-              Write-Host "##vso[task.setsecret]$accessToken"
-              # Override the apitoken of the nuget service connection, for the duration of this stage
-              Write-Host "##vso[task.setendpoint id=a7e33797-4804-4a1d-911d-5bd325e50a85;field=authParameter;key=apitoken]$accessToken"
-  
-        - task: 1ES.PublishNuGet@1
-          displayName: NuGet push to ms/react-native-public
-          inputs:
-            useDotNetTask: true
+        - template: .ado/templates/publish-nuget-to-ado-feed.yml@self
+          parameters:
+            endpointId: 'a7e33797-4804-4a1d-911d-5bd325e50a85'
+            nugetFeedUrl: 'https://pkgs.dev.azure.com/ms/_packaging/react-native/nuget/v3/index.json'
             packageParentPath: '$(Pipeline.Workspace)/ReactWindows-final-nuget'
             packagesToPush: '$(Pipeline.Workspace)/ReactWindows-final-nuget/*.nupkg'
-            nuGetFeedType: external
             publishFeedCredentials: 'ms/react-native ADO Feed'
-            externalEndpoint: 'ms/react-native ADO Feed'
-            publishPackageMetadata: true
+            feedDisplayName: 'ms/react-native'
 
       - job: PushPublicAdo
         displayName: ADO - nuget - react-native-public
-        
+        timeoutInMinutes: 30
         templateContext:
+          type: releaseJob
+          isProduction: true
           inputs:
           - input: pipelineArtifact
             pipeline: 'Publish'
             artifactName: 'ReactWindows-final-nuget'
             targetPath: '$(Pipeline.Workspace)/ReactWindows-final-nuget'
-        
         steps:
-        - checkout: none
-
-        - script: dir /S $(Pipeline.Workspace)\ReactWindows-final-nuget
-          displayName: Show directory contents
-
-        - task: AzureCLI@2
-          displayName: Override NuGet credentials with Managed Identity
-          inputs:
-            azureSubscription: 'Office-React-Native-Windows-Bot'
-            visibleAzLogin: false
-            scriptType: 'pscore'
-            scriptLocation: 'inlineScript'
-            inlineScript: |
-              $accessToken = az account get-access-token --query accessToken --resource 499b84ac-1321-427f-aa17-267ca6975798 -o tsv
-              # Set the access token as a secret, so it doesn't get leaked in the logs
-              Write-Host "##vso[task.setsecret]$accessToken"
-              # Override the apitoken of the nuget service connection, for the duration of this stage
-              Write-Host "##vso[task.setendpoint id=9a2456d0-c163-405b-be24-c03fd74b155a;field=authParameter;key=apitoken]$accessToken"
-  
-        - task: 1ES.PublishNuGet@1
-          displayName: NuGet push to ms/react-native-public
-          inputs:
-            useDotNetTask: true
+        - template: .ado/templates/publish-nuget-to-ado-feed.yml@self
+          parameters:
+            endpointId: '9a2456d0-c163-405b-be24-c03fd74b155a'
+            nugetFeedUrl: 'https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/nuget/v3/index.json'
             packageParentPath: '$(Pipeline.Workspace)/ReactWindows-final-nuget'
             packagesToPush: '$(Pipeline.Workspace)/ReactWindows-final-nuget/*.nupkg'
-            nuGetFeedType: external
             publishFeedCredentials: 'ms/react-native-public ADO Feed'
-            externalEndpoint: 'ms/react-native-public ADO Feed'
-            publishPackageMetadata: true
+            feedDisplayName: 'ms/react-native-public'
 
       - job: PushNuGetOrg
         displayName: nuget.org - Push nuget packages
         variables:
         - group: RNW Secrets
-        timeoutInMinutes: 0
+        timeoutInMinutes: 30
         templateContext:
+          type: releaseJob
+          isProduction: true
           inputs:
           - input: pipelineArtifact
             pipeline: 'Publish'
             artifactName: 'ReactWindows-final-nuget'
             targetPath: '$(Pipeline.Workspace)/ReactWindows-final-nuget'
         steps:
-        - checkout: none
         - task: NuGetToolInstaller@1
-          displayName: 'Use NuGet '
+          displayName: 'Use NuGet'
         - task: CmdLine@2
           displayName: NuGet SetApiKey (nuget.org)
           inputs:
             script: nuget.exe SetApiKey $(nugetorg-apiKey-push)
             workingDirectory: $(Pipeline.Workspace)/ReactWindows-final-nuget
-        - task: PowerShell@2
+        - script: dir /S "$(Pipeline.Workspace)\ReactWindows-final-nuget"
+          displayName: Show directory contents
+        - script: nuget.exe push .\Microsoft.ReactNative.*.nupkg -Source https://api.nuget.org/v3/index.json -SkipDuplicate -NoSymbol -NonInteractive -Verbosity Detailed
           displayName: NuGet push (nuget.org)
-          inputs:
-            targetType: inline
-            errorActionPreference: silentlyContinue
-            script: |
-              if (Get-ChildItem -Path .\ -Filter '*0.0.0-canary*' -ErrorAction SilentlyContinue) { Write-Output "Canary builds found, exiting."; return 0; }
-              nuget.exe push .\Microsoft.ReactNative.*.nupkg -Source https://api.nuget.org/v3/index.json -SkipDuplicate -NoSymbol -NonInteractive -Verbosity Detailed
-            workingDirectory: $(Pipeline.Workspace)/ReactWindows-final-nuget
+          workingDirectory: $(Pipeline.Workspace)/ReactWindows-final-nuget