Sync main pipeline changes to 0.81-stable branch (#16413)

Author: vmoroz

.ado/README.md

@@ -13,7 +13,6 @@ setup and the network-isolation workarounds.
 | CI | `ci-pipeline.yml` | `ISS` | `Office.Official` | signed Official build; `trigger` branch filters and a weekly heartbeat `schedule` are defined in YAML |
 | PR | `pr-pipeline.yml` | public (`ms`) | `1ES.Unofficial` | validation build for GitHub PRs |
 | Release | `release-pipeline.yml` | `ISS` | `Office.Official` | triggered by CI completion; publishes packages and symbols |
-| Feed warm-up | `warm-feed-cache-pipeline.yml` | `ISS` | `Office.Unofficial` | scheduled; keeps `ms/react-native-public` populated for anonymous PR restores |
 
 CI and PR share all build/test/pack logic through `build-template.yml`; the
 `buildEnvironment` parameter (`Continuous` vs `PullRequest`) gates the
@@ -71,9 +70,9 @@ otherwise hide:
   agent image.
 
 Public PR builds read this feed **anonymously**, so they can only restore versions
-an authenticated identity has already saved. `warm-feed-cache-pipeline.yml` (script:
-`vnext/Scripts/Warm-RnwFeedCache.ps1`) runs on a schedule to pre-populate the npm
-and NuGet dependency closures and keep those anonymous restores working.
+an authenticated identity has already saved. A scheduled feed warm-up (maintained on
+`main`, branch-agnostic) pre-populates the npm and NuGet dependency closures on the
+feed and keeps those anonymous restores working.
 
 ## SDL and Component Governance
 

.ado/ci-pipeline.yml

@@ -8,9 +8,9 @@ name: 0.0.$(Date:yyMM.d)$(Rev:rrr)
 trigger:
   branches:
     include:
+    # Supported branches
     - main
     - '0.81-stable'
-    - '0.82-stable'
     - '0.83-stable'
     - '0.84-stable'
     - '0.85-stable'

.ado/pr-pipeline.yml

@@ -8,9 +8,14 @@ name: $(Date:yyyyMMdd).$(Rev:r)
 trigger: none
 
 pr:
+  # Supported branches
   - main
-  - master
-  - "*-stable"
+  - '0.81-stable'
+  - '0.83-stable'
+  - '0.84-stable'
+  - '0.85-stable'
+  - '0.86-stable'
+  - '0.87-stable'
 
 variables:
   - group: platform-override-zero-permission-token

.ado/prepare-release-bot.yml

@@ -1,10 +1,17 @@
 name: $(Date:yyyyMMdd).$(Rev:r)
 
-# Triggers are configured in the ADO pipeline UI:
-# - CI triggers on pushes to main and *-stable branches
-# - Scheduled triggers for daily runs
-# - Manual runs with optional branch override
-trigger: none
+# CI trigger on the supported branches; also queued manually (targetBranch parameter).
+trigger:
+  branches:
+    include:
+    # Supported branches
+    - main
+    - '0.81-stable'
+    - '0.83-stable'
+    - '0.84-stable'
+    - '0.85-stable'
+    - '0.86-stable'
+    - '0.87-stable'
 pr: none
 
 parameters:
@@ -13,12 +20,15 @@ parameters:
     type: string
     default: (source branch)
     values:
+      # Supported branches
       - (source branch)
       - main
-      - 0.82-stable
       - 0.81-stable
-      - 0.80-stable
-      - 0.74-stable
+      - 0.83-stable
+      - 0.84-stable
+      - 0.85-stable
+      - 0.86-stable
+      - 0.87-stable
 
 jobs:
   - job: PrepareRelease

.ado/release-pipeline.yml

@@ -42,9 +42,9 @@ resources:
     trigger:
       branches:
         include:
+        # Supported branches
         - main
         - '0.81-stable'
-        - '0.82-stable'
         - '0.83-stable'
         - '0.84-stable'
         - '0.85-stable'

.ado/scripts/npmPack.js

@@ -17,7 +17,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { execSync } = require('child_process');
+const { execSync, execFileSync } = require('child_process');
 const { parseArgs } = require('util');
 
 // ANSI color codes
@@ -219,12 +219,17 @@ function isPrivatePackage(packageJsonPath) {
  * @returns {boolean} True if the package version is already published
  */
 function isPublishedOnNpm(packageName, version, registry) {
-  const registryArg = registry ? ` --registry ${registry}` : '';
+  // Shell-free npm invocation (node + its CLI, values as argv) so a caller-controlled
+  // registry/package/version can't inject; npm's Windows .cmd shim needs a shell otherwise.
+  const npmCli = path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
+  const args = [npmCli, 'view', `${packageName}@${version}`, 'version'];
+  if (registry) {
+    args.push('--registry', registry);
+  }
   try {
-    // Use npm view to check if the specific version exists
-    execSync(`npm view ${packageName}@${version} version${registryArg}`, {
+    execFileSync(process.execPath, args, {
       encoding: 'utf8',
-      stdio: ['pipe', 'pipe', 'pipe']
+      stdio: ['pipe', 'pipe', 'pipe'],
     });
     return true;
   } catch (error) {

.ado/warm-feed-cache-pipeline.yml

@@ -3,3 +3,16 @@ enableScripts: false
 yarnPath: .yarn/releases/yarn-4.13.0.cjs
 
 nodeLinker: node-modules
+
+# Don't pin a version younger than the ms/react-native-public feed's 7-day upstream
+# quarantine (8 = 7 + 1d margin), so yarn.lock only holds versions the feed can serve.
+# Exempt our first-party scopes, plus the upstream react-native family that integrate-rn
+# pins to exact nightlies (the age gate rejects even exact versions).
+npmMinimalAgeGate: "8d"
+npmPreapprovedPackages:
+  - "react-native-windows"
+  - "@react-native-windows/*"
+  - "@rnw-scripts/*"
+  - "@office-iss/*"
+  - "react-native"
+  - "@react-native/*"

.yarnrc.yml

@@ -0,0 +1,7 @@
+{
+  "type": "patch",
+  "comment": "Retain license, README, and docs in vendored folly, fmt, and fast-float, and update the example Metro config for create-react-native-library 0.63",
+  "packageName": "react-native-windows",
+  "email": "vmorozov@microsoft.com",
+  "dependentChangeType": "patch"
+}