[0.80] Fix NPM dist tags and make some NPM private (#15416) (#15437)

* Fix NPM dist tags and make some NPM private (#15416)

* Change files

Author: vmoroz

.ado/publish.yml

@@ -211,53 +211,6 @@ extends:
           - script: dir /s "$(Pipeline.Workspace)\published-packages"
             displayName: Show created npm packages
 
-          # Beachball usually takes care about the NPM package tagging based on the values in package.json files.
-          # We use the ESRP Release where we must provide the tag explictly (the productstate parameter).
-          # Fortunately, we just use two tags: latest and some custom tag like "canary", "v0.73-stable", etc.
-          # The npmGroupByTag.js script groups the created NPM package by these two tags into the specified folders.
-          - pwsh: |
-              node .ado/scripts/npmGroupByTag.js "$(Pipeline.Workspace)\published-packages" "$(Pipeline.Workspace)\published-packages\custom-tag" "$(Pipeline.Workspace)\published-packages\latest-tag"
-            displayName: Group npm packages by tag
-
-          - script: dir /s "$(Pipeline.Workspace)\published-packages"
-            displayName: Show grouped npm packages by tag
-
-          # Publish NPM packages using ESRP Release task with the custom tag such as "canary", "v0.73-stable", etc.
-          - task: 'SFP.release-tasks.custom-build-release-task.EsrpRelease@10'
-            displayName: 'ESRP Release to npmjs.com (custom tag)'
-            condition: and(succeeded(), ${{ not(parameters.skipNpmPublish) }}, eq(variables['NpmCustomFolderHasContent'], 'true'))
-            inputs:
-              connectedservicename: 'ESRP-CodeSigning-OGX-JSHost-RNW'
-              usemanagedidentity: false
-              keyvaultname: 'OGX-JSHost-KV'
-              authcertname: 'OGX-JSHost-Auth4'
-              signcertname: 'OGX-JSHost-Sign3'
-              clientid: '0a35e01f-eadf-420a-a2bf-def002ba898d'
-              domaintenantid: 'cdc5aeea-15c5-4db6-b079-fcadd2505dc2'
-              contenttype: npm
-              folderlocation: '$(NpmCustomFolder)'
-              productstate: '$(NpmCustomTag)'
-              owners: 'vmorozov@microsoft.com'
-              approvers: 'khosany@microsoft.com'
-
-          # Publish NPM packages using ESRP Release task with the "latest" tag.
-          - task: 'SFP.release-tasks.custom-build-release-task.EsrpRelease@10'
-            displayName: 'ESRP Release to npmjs.com (latest)'
-            condition: and(succeeded(), ${{ not(parameters.skipNpmPublish) }}, eq(variables['NpmLatestFolderHasContent'], 'true'))
-            inputs:
-              connectedservicename: 'ESRP-CodeSigning-OGX-JSHost-RNW'
-              usemanagedidentity: false
-              keyvaultname: 'OGX-JSHost-KV'
-              authcertname: 'OGX-JSHost-Auth4'
-              signcertname: 'OGX-JSHost-Sign3'
-              clientid: '0a35e01f-eadf-420a-a2bf-def002ba898d'
-              domaintenantid: 'cdc5aeea-15c5-4db6-b079-fcadd2505dc2'
-              contenttype: npm
-              folderlocation: '$(NpmLatestFolder)'
-              productstate: 'latest'
-              owners: 'vmorozov@microsoft.com'
-              approvers: 'khosany@microsoft.com'
-
           # Beachball reverts to local state after publish, but we want the updates it added
           - script: git pull origin $(SourceBranchWithFolders)
             displayName: git pull

.ado/release.yml

@@ -26,12 +26,51 @@ extends:
     customBuildTags:
     - ES365AIMigrationTooling-Release
     stages:
-    - stage: PushToPrivateAdoStage
-      displayName: ADO - react-native
+    - stage: Release
+      displayName: Publish artifacts
       jobs:
-      - job: PushPackages
-        displayName: Push packages
-        condition: succeeded()
+      - job: PushNpm
+        displayName: npmjs.com - Publish npm packages
+        variables:
+        - group: RNW Secrets
+        timeoutInMinutes: 0
+        templateContext:
+          inputs:
+          - input: pipelineArtifact
+            pipeline: 'Publish'
+            artifactName: 'NpmPackedTarballs'
+            targetPath: '$(Pipeline.Workspace)/published-packages'
+          - input: pipelineArtifact
+            pipeline: 'Publish'
+            artifactName: 'VersionEnvVars'
+            targetPath: '$(Pipeline.Workspace)/VersionEnvVars'
+        steps:
+        - checkout: none
+        - task: CmdLine@2
+          displayName: Apply version variables
+          inputs:
+            script: node $(Pipeline.Workspace)/VersionEnvVars/versionEnvVars.js
+        - script: dir /s "$(Pipeline.Workspace)\published-packages"
+          displayName: Show npm packages
+        - task: 'SFP.release-tasks.custom-build-release-task.EsrpRelease@10'
+          displayName: 'ESRP Release to npmjs.com'
+          condition: and(succeeded(), ne(variables['NpmDistTag'], ''))
+          inputs:
+            connectedservicename: 'ESRP-CodeSigning-OGX-JSHost-RNW'
+            usemanagedidentity: false
+            keyvaultname: 'OGX-JSHost-KV'
+            authcertname: 'OGX-JSHost-Auth4'
+            signcertname: 'OGX-JSHost-Sign3'
+            clientid: '0a35e01f-eadf-420a-a2bf-def002ba898d'
+            domaintenantid: 'cdc5aeea-15c5-4db6-b079-fcadd2505dc2'
+            contenttype: npm
+            folderlocation: '$(Pipeline.Workspace)\published-packages'
+            productstate: '$(NpmDistTag)'
+            owners: 'vmorozov@microsoft.com'
+            approvers: 'khosany@microsoft.com'
+
+      - job: PushPrivateAdo
+        displayName: ADO - react-native
         timeoutInMinutes: 0
         templateContext:
           inputs:
@@ -52,12 +91,9 @@ extends:
           inputs:
             script: nuget.exe push *.nupkg -ApiKey AzureArtifacts -Source https://pkgs.dev.azure.com/ms/_packaging/react-native/nuget/v3/index.json -NonInteractive -Verbosity Detailed -SkipDuplicate -NoSymbols
             workingDirectory: $(Pipeline.Workspace)/ReactWindows-final-nuget
-    - stage: PushToPublicAdoStage
-      displayName: ADO - react-native-public
-      jobs:
-      - job: PushPackages
-        displayName: Push packages
-        condition: succeeded()
+
+      - job: PushPublicAdo
+        displayName: ADO - react-native-public
         timeoutInMinutes: 0
         templateContext:
           inputs:
@@ -78,13 +114,11 @@ extends:
           inputs:
             script: nuget.exe push *.nupkg -ApiKey AzureArtifacts -Source https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/nuget/v3/index.json -NonInteractive -Verbosity Detailed -SkipDuplicate -NoSymbols
             workingDirectory: $(Pipeline.Workspace)/ReactWindows-final-nuget
-    - stage: PushToNuGetStage
-      displayName: nuget.org - Push nuget packages
-      variables:
-      - group: RNW Secrets
-      jobs:
-      - job: PushPackages
-        displayName: Push packages
+
+      - job: PushNuGetOrg
+        displayName: nuget.org - Push nuget packages
+        variables:
+        - group: RNW Secrets
         timeoutInMinutes: 0
         templateContext:
           inputs:

.ado/scripts/npmGroupByTag.js

@@ -37,6 +37,11 @@ const versionEnvVars = {
   publishCommitId: commitId,
   reactDevDependency: pkgJson.devDependencies['react'],
   reactNativeDevDependency: pkgJson.devDependencies['react-native'],
+  npmDistTag: pkgJson?.beachball?.defaultNpmTag?.trim(),
+}
+
+if (!versionEnvVars.npmDistTag) {
+  throw new Error('defaultNpmTag is missing in vnext/package.json');
 }
 
 // Set the build number so the build in the publish pipeline and the release pipeline are named with the convenient version
@@ -54,8 +59,14 @@ console.log(`##vso[task.setvariable variable=npmVersion]${versionEnvVars.npmVers
 console.log(`##vso[task.setvariable variable=publishCommitId]${versionEnvVars.publishCommitId}`);
 console.log(`##vso[task.setvariable variable=reactDevDependency]${versionEnvVars.reactDevDependency}`);
 console.log(`##vso[task.setvariable variable=reactNativeDevDependency]${versionEnvVars.reactNativeDevDependency}`);
+console.log(`##vso[task.setvariable variable=NpmDistTag]${versionEnvVars.npmDistTag}`);
+
+const runnerTemp = process.env.RUNNER_TEMP;
+if (!runnerTemp) {
+  throw new Error('RUNNER_TEMP environment variable is not set');
+}
 
-const dirPath = path.resolve(process.env.RUNNER_TEMP, 'versionEnvVars');
+const dirPath = path.resolve(runnerTemp, 'versionEnvVars');
 fs.mkdirSync(dirPath, {recursive: true});
 
 fs.writeFileSync(path.resolve(dirPath, 'versionEnvVars.js'),
@@ -68,4 +79,5 @@ console.log("##vso[task.setvariable variable=npmVersion]${versionEnvVars.npmVers
 console.log("##vso[task.setvariable variable=publishCommitId]${versionEnvVars.publishCommitId}");
 console.log("##vso[task.setvariable variable=reactDevDependency]${versionEnvVars.reactDevDependency}");
 console.log("##vso[task.setvariable variable=reactNativeDevDependency]${versionEnvVars.reactNativeDevDependency}");
+console.log("##vso[task.setvariable variable=NpmDistTag]${versionEnvVars.npmDistTag}");
 `);

.ado/scripts/setVersionEnvVars.js

@@ -0,0 +1,7 @@
+{
+  "type": "patch",
+  "comment": "Fix NPM dist tags and make some NPM private (#15416)",
+  "packageName": "@office-iss/react-native-win32",
+  "email": "vmorozov@microsoft.com",
+  "dependentChangeType": "patch"
+}

change/@office-iss-react-native-win32-d25e3573-b504-4374-b411-542539be1ea6.json

@@ -0,0 +1,7 @@
+{
+  "type": "patch",
+  "comment": "Fix NPM dist tags and make some NPM private (#15416)",
+  "packageName": "@react-native-windows/automation-channel",
+  "email": "vmorozov@microsoft.com",
+  "dependentChangeType": "patch"
+}