Address network isolation issues

.ado/build-template.yml

@@ -163,6 +163,15 @@ extends:
               value: --sanitize-handles
             ${{ else }}:
               value: --no-sanitize-handles
+            # Route npm through the ms/react-native-public feed (npmjs.org
+            # upstream) so the Node-API test toolchain restores from the feed.
+          - name: NPM_CONFIG_REGISTRY
+            value: https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/
+          - name: NPM_CONFIG_CACHE
+            value: $(Agent.TempDirectory)/.npmCache
+            # Fail instead of letting npx silently fetch a networked tool.
+          - name: NPM_CONFIG_YES
+            value: "false"
 
           templateContext:
             outputs:

.ado/scripts/.npmrc

@@ -0,0 +1,2 @@
+# ms/react-native-public is a public (anonymous-read) feed; do not add auth here.
+registry=https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/

.github/dependabot.yml

@@ -1,6 +1,16 @@
 version: 2
+# Resolve npm/yarn updates through the ms/react-native-public feed (a public,
+# anonymous-read proxy of npmjs.org) so regenerated lockfiles stay feed-pinned.
+registries:
+  react-native-public:
+    type: npm-registry
+    url: https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/
+    # Public feed; no credentials needed.
+    replaces-base: true
 updates:
 - package-ecosystem: npm
+  registries:
+  - react-native-public
   directories:
   - "/"
   - "/.ado/scripts"
@@ -13,7 +23,8 @@ updates:
   - "/utils/promise"
   - "/utils/scripts/hermes"
   schedule:
-    interval: daily
+    interval: weekly
+    day: "monday"
     time: "05:00"
     timezone: "America/Los_Angeles"
   labels:

.yarnrc

@@ -0,0 +1,4 @@
+# Resolve npm packages through the ms/react-native-public feed (a public,
+# anonymous-read proxy of npmjs.org) instead of the default registry. yarn walks
+# up from each project directory, so this applies to the whole repo.
+registry "https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/"

tools/fork-sync/.npmrc

@@ -0,0 +1,2 @@
+# ms/react-native-public is a public (anonymous-read) feed; do not add auth here.
+registry=https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/

tools/hcdp/.npmrc

@@ -0,0 +1,2 @@
+# ms/react-native-public is a public (anonymous-read) feed; do not add auth here.
+registry=https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/

tools/hermes-parser/js/yarn.lock

@@ -2210,17 +2210,17 @@ binary-extensions@^2.0.0:
   integrity sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==
 
 brace-expansion@^1.1.7:
-  version "1.1.14"
-  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.14.tgz#d9de602370d91347cd9ddad1224d4fd701eb348b"
-  integrity sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==
+  version "1.1.17"
+  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.17.tgz#a375e14e41d672617de69526be02d0d7751a6909"
+  integrity sha512-w+aeW/mkgM4PyRMOJCgi3fOrTm5Q8QY1OSfn2TO2iuDj3ezIHqejmuxbjfPrqUkgqRew1iqkyAn0tr0ZwHD9+w==
   dependencies:
     balanced-match "^1.0.0"
     concat-map "0.0.1"
 
 brace-expansion@^2.0.1, brace-expansion@^2.0.2:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.1.0.tgz#4f41a41190216ee36067ec381526fe9539c4f0ae"
-  integrity sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==
+  version "2.1.3"
+  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.1.3.tgz#1bf69aacdf6a4380ca17c284d9f928d4aa6401bc"
+  integrity sha512-DRdx5neNsG/QXbniLFWi2YmC/68oeOOmKz6zOjVk6ZS1ZLXgLIKqVEc6hWsmkjBbgii0SwaBTcJ5XKj5gzY/4A==
   dependencies:
     balanced-match "^1.0.0"
 

unittests/NodeApi/test/.npmrc

@@ -0,0 +1,2 @@
+# ms/react-native-public is a public (anonymous-read) feed; do not add auth here.
+registry=https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/

unittests/NodeApi/test/CMakeLists.txt

@@ -7,14 +7,17 @@ else()
   set(npm "npm")
 endif()
 
-# copy JS Tools package files
+# copy JS Tools package files. The .npmrc pins the registry to the approved ADO
+# feed so `npm ci` below does not reach registry.npmjs.org.
 add_custom_command(
   OUTPUT
+    ${CMAKE_CURRENT_BINARY_DIR}/.npmrc
     ${CMAKE_CURRENT_BINARY_DIR}/babel.config.js
     ${CMAKE_CURRENT_BINARY_DIR}/package.json
     ${CMAKE_CURRENT_BINARY_DIR}/package-lock.json
     ${CMAKE_CURRENT_BINARY_DIR}/postinstall.mjs
   COMMAND ${CMAKE_COMMAND} -E copy_if_different
+    ${CMAKE_CURRENT_SOURCE_DIR}/.npmrc
     ${CMAKE_CURRENT_SOURCE_DIR}/babel.config.js
     ${CMAKE_CURRENT_SOURCE_DIR}/package.json
     ${CMAKE_CURRENT_SOURCE_DIR}/package-lock.json
@@ -23,13 +26,14 @@ add_custom_command(
 )
 add_custom_target(copyNodeApiJSToolsFiles)
 
-# run "npm install"
+# run "npm ci" for a deterministic install that fails on lockfile drift
 add_custom_command(
   OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/node_modules.sha256
   DEPENDS
+    ${CMAKE_CURRENT_BINARY_DIR}/.npmrc
     ${CMAKE_CURRENT_BINARY_DIR}/package.json
     ${CMAKE_CURRENT_BINARY_DIR}/package-lock.json
-  COMMAND ${npm} install
+  COMMAND ${npm} ci
   WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
 )
 add_custom_target(installNodeApiTestJsTools