[0.81] Move CI/Release pipelines to office/ISS ADO project

[Vladimir Morozov (vmoroz)]

Description

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• Automation (CI/pipeline changes)

Why

Backports #16350 and #16359 to 0.81-stable, moving the CI and Release pipelines
to the office/ISS Azure DevOps project (the same move already made on main).

Builds in that project are network-isolated, run on the Office 1ES pipeline
templates, and restore packages from an internal feed. To pass there the build has
to be self-contained: no outbound network at build time, no unapproved package
sources, and a clean Component Governance scan. This PR also carries the fixes
0.81-stable needs to build and go green under those constraints.

What

CI and Release pipeline migration

• CI (ci-pipeline.yml) and PR (pr-pipeline.yml) now extend the Office/1ES
  pipeline templates and run on the internal x64 pool with the
  rnw-img-vs2026-node24 image. CI triggers on main and the active
  0.8x-stable branches, plus a weekly heartbeat so it is not auto-disabled.
• Release pipeline rewritten as release-pipeline.yml plus templates; the old
  release.yml, publish.yml, and windows-vs-pr.yml are removed.
• Package publishing to the internal ADO feeds is added for parity with NuGet
  (publish-npm-to-ado-feed.yml), along with publish-symbols.yml.
• Feed access is authenticated only on Continuous (CI) builds
  (auth-npm-feed.yml); PR builds read the pre-warmed feed anonymously.
• New .ado/README.md documents the pipeline layout.

Yarn 4 (Berry)

• Adopt Yarn 4.13.0: commit .yarn/releases/yarn-4.13.0.cjs, set
  packageManager: yarn@4.13.0, and regenerate yarn.lock (this accounts for
  most of the diff's line count). The CI install step moves from
  midgard-yarn-strict to yarn install --immutable. Adds a string_decoder
  shim wired in as a portal: resolution.

Feed warming

• New vnext/Scripts/Warm-RnwFeedCache.ps1 and warm-feed-cache-pipeline.yml
  pre-populate the internal feed (build tools, the app/lib CLI-init dependency
  closures, the repo's own published packages, and the NuGet closure) so
  network-isolated PR builds can restore anonymously.

Component Governance security bumps

• package.json resolutions pin vulnerable transitive dependencies to patched
  versions (basic-ftp, simple-git, shell-quote, form-data, ws, minimatch,
  js-yaml, yaml, picomatch, nanoid, linkify-it, and others), with a regenerated
  yarn.lock. uuid is moved to 14.x because that is the only release line with
  the fix. extract-zip has no fixed release yet and is baselined in
  GuardianCustomConfiguration.json.

NuGet restore fixes

• Bump the Hermes package 0.0.0-2604.21001-94aa5e1d →
  0.0.0-2608.12001-35d34796 to pick up crash fixes; lockfiles updated.
• Fix NU1403 on the UWP .NET Native framework packages: commit an empty UWP
  fallback folder (.nuget/empty-uwp-fallback) and point restore at it so those
  machine-injected, SDK-versioned packages resolve from the feed instead of a
  local copy whose content hash differs per machine.
• Harden NuGetRestoreForceEvaluateAllSolutions.ps1 for VS 2026 (MSB4086/MSB4184
  guards, strip nuget.org from a node_modules NuGet.Config, guard an empty
  PlatformToolsetVersion).

Network isolation

• Replace five facebook.com image URLs in the tester examples with an inline 1×1
  data: PNG (updated overrides and snapshots) so the tests do not reach the
  internet.
• Disable the Visual Studio Installer background auto-update download in the VM
  image (BackgroundDownloadDisabled=1) so it stops calling the VS CDN during
  isolated builds.

Reduced complexity

• Remove the CLI init-verification stage from the CI build template.

VM image

• Add/update the .ado/image/rnw-img-vs2026-node24.json image definition used by
  the pipelines.

Testing

• Exercised through the migrated CI and PR pipelines on this branch in the
  office/ISS project: Yarn 4 install, NuGet restore, the native builds, and the
  network-isolation checks run under the isolated build.
• uuid 14.x (a major bump) has only been smoke-tested via require; it has not
  had a full build validated.

Changelog

Should this change be included in the release notes: no

CI/build-infrastructure and security-dependency changes, not
user-facing runtime changes. Change files (type patch) are included for the
affected packages.

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

[Copilot]

Pull request overview

Copilot reviewed 40 out of 40 changed files in this pull request and generated 3 comments.

Suppressed comments (4)

vnext/Scripts/Warm-RnwFeedCache.ps1:76

• This default is copied from the newer branch, but the 0.81 CLI-init script pins @react-native-community/template@0.81.0-nightly-202565-2f67cec. For any nightly warm-up (including the documented -ReactNativeVersion example), this generates a different dependency closure than creaternwapp.cmd, so the feed is not warmed for the packages the 0.81 CLI test actually restores.
  vnext/Scripts/Warm-RnwFeedCache.ps1:90
• UpdateNightlyDependencies.ps1 is not present in this backport, so every invocation with a nightly React Native version fails when Update-NightlyPackageJson tries to call this path. PR #16350 added that helper alongside these callers; please backport it as well.
  .ado/README.md:84
• This statement is not true for the backport: #16350's package.json, yarn.lock, and string_decoder shim changes were omitted, and this branch still resolves versions such as linkify-it 5.0.0 that the source PR pinned to address Component Governance. Either port branch-compatible dependency fixes and regenerate the lockfile or revise this claim; otherwise the new Office SDL run can still report the alerts described as cleared.

this repo). `guardian/sdl/.gdnsuppress` is an **empty** suppression set: all
Component Governance alerts are fixed at the source (dependency `resolutions` in the
root `package.json`), so nothing is suppressed.

docs/build-pipelines.md:3

• The new scheduled feed warm-up is a fourth Azure DevOps pipeline, so the documented count is now stale.

[Copilot]

Pull request overview

Copilot reviewed 87 out of 90 changed files in this pull request and generated 1 comment.

Suppressed comments (3)

vnext/Scripts/creaternwlib.cmd:148

• The backported PR explicitly says creaternwlib.cmd should stop on the first error, but these new Git commands and the subsequent Yarn/init commands still have no ERRORLEVEL checks. A failed install, commit, or init-windows is followed by more successful commands, and the final popd can therefore leave this script reporting success to the pipeline. Add fail-fast handling for each external command rather than only checking the initial generator.
  vnext/Scripts/creaternwapp.cmd:150
• The backported PR explicitly says creaternwapp.cmd should stop on the first error, but the new Git commands and the subsequent Yarn/init commands still have no ERRORLEVEL checks. A failed install, commit, or init-windows is followed by more successful commands, and the final popd can therefore leave this script reporting success to the pipeline. Add fail-fast handling for each external command rather than only checking the initial generator.
  packages/react-native-windows-init/src/Cli.ts:11
• These spacing-only edits conflict with the repository formatter: .prettierrc:6 sets bracketSpacing to false, and the rest of this package uses forms such as {GenerateWindows, GenerateWindows62}. yarn format:verify will reject this file. Run the repository formatter so all object/import braces in this file return to the configured style.

[Copilot]

Pull request overview

Copilot reviewed 87 out of 90 changed files in this pull request and generated 2 comments.

Suppressed comments (6)

.yarnrc.yml:3

• yarnPath points every Yarn invocation at .yarn/releases/yarn-4.13.0.cjs, but that file is not present in this change or the checkout. Yarn therefore exits before dependency installation, breaking the new --immutable CI steps. Commit the pinned release file (or remove yarnPath and provision Yarn 4 through a reliable mechanism).
  vnext/Scripts/creaternwlib.cmd:148
• The backported PR explicitly says these scripts now stop on the first error, but the newly added git config calls (like the other post-generation calls) are not checked. A failed config/commit/init can be masked by later successful commands, leaving this CI step green with an incomplete library. Add fail-fast checks after each external command in both CLI scripts.
  vnext/Scripts/creaternwapp.cmd:150
• The backported PR explicitly says these scripts now stop on the first error, but the newly added git config calls (like the other post-generation calls) are not checked. Their failures can be masked by later successful commands, so the app-init CI step may report success after an incomplete setup. Add fail-fast checks after each external command in both CLI scripts.
  .ado/release-pipeline.yml:253
• This job runs in parallel with PushNpm, whose --check-npm eligibility check uses this same public ADO registry via the pipeline-level NPM_CONFIG_REGISTRY. If this mirror publishes first, PushNpm sees the new version in ADO, removes its tarball, and skips npmjs.com publishing. Make the npmjs check authoritative and independent of the mirror, or order the ADO mirror jobs after PushNpm.

        - template: .ado/templates/publish-npm-to-ado-feed.yml@self
          parameters:
            azureSubscription: ${{ parameters.adoFeedServiceConnection }}
            npmFeedRegistry: 'https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/'
            packagesPath: '$(Pipeline.Workspace)/npm-feed-packages'

docs/build-pipelines.md:3

• The PR adds a fourth Azure DevOps pipeline (warm-feed-cache-pipeline.yml), but this overview still says there are three and omits it from the table. This now conflicts with .ado/README.md:11-16; include the feed warm-up entry here as well.
  .ado/README.md:93
• This release-target list omits the two new npm ADO destinations even though release-pipeline.yml adds both jobs and lines 3-5 say npm is mirrored into both feeds. As written, the documentation understates the release behavior and its “all five destinations” count is no longer accurate.

`release-pipeline.yml` publishes from ISS to all five destinations:

- npm → npmjs.com via `EsrpRelease@11`
- NuGet → `ms/react-native` (private) and `ms/react-native-public` (public) feeds
- NuGet → nuget.org (API key from `OGX-JSHost-KV`)

[Copilot]

Pull request overview

Copilot reviewed 87 out of 90 changed files in this pull request and generated 1 comment.

Suppressed comments (8)

.yarnrc.yml:3

• yarnPath points to a file that is not present in this PR or checkout. Every root yarn invocation will try to load this missing file, so the new yarn install --immutable steps fail before installing dependencies. Commit the pinned Yarn release at this path (or remove yarnPath and provision Yarn 4 another way).
  vnext/Scripts/creaternwapp.cmd:150
• This backport includes the new Git identity but omits the surrounding fail-fast changes from #16350. A failed yarn install, git config, yarn add, or init-windows can still be overwritten by a later successful command, making the CLI-init pipeline report success for a broken generated app. Restore the if errorlevel 1 goto :failure checks and preserved exit-code epilogue.
  vnext/Scripts/creaternwlib.cmd:148
• This backport includes the new Git identity but omits the surrounding fail-fast changes from #16350. Failures from the preceding install or later yarn add, commit, and init-windows calls can be masked by subsequent commands, producing a false-green CLI library job. Restore the parent PR's error checks and preserved exit-code epilogue.
  packages/react-native-windows-init/src/Cli.ts:11
• This file has @format, but the change adds spaces inside braces throughout, contrary to bracketSpacing: false in .prettierrc:6. The format:verify CI step will reject it; run the repository formatter so all of these additions use the configured style.
  .ado/build-template.yml:603
• The backport deletes the entire CLI stage, so neither CI nor PR validates react-native init/init-windows against the produced packages. This contradicts docs/build-pipelines.md:15,22,51-53 and removes the consumer of the Verdaccio/feed work added here. Restore the stage after Tests.
  .ado/variables/shared.yml:16
• The network-isolation backport is incomplete: the tester sources still load images from Facebook, Giphy, Pexels, and fbcdn URLs (for example packages/@react-native-windows/tester/src/js/examples/Image/ImageExample.windows.js:24-26,403,604 and packages/@react-native/tester/js/examples/AnimatedGratuitousApp/AnExScroll.js:115-118). Those replacements were part of #16350; without them, E2E runs can still attempt blocked egress.
  package.json:66
• The Component Governance fixes from #16350 were not fully backported. In particular, the root resolution and local string_decoder shim are absent, while this PR's lockfile still resolves string_decoder 1.1.1 and 1.3.0. This leaves the no-fix advisory that the parent PR explicitly removed, so the claim of zero alerts will not hold.
  docs/build-pipelines.md:3
• The PR adds a fourth pipeline (warm-feed-cache-pipeline.yml), but this overview still says there are three and its table omits the warm-up pipeline. Update the count and add the scheduled Office Unofficial pipeline so this document matches .ado/README.md:11-16.

[Copilot]

Pull request overview

Copilot reviewed 193 out of 197 changed files in this pull request and generated 1 comment.

Suppressed comments (4)

vnext/Scripts/creaternwapp.cmd:150

• This backport omits #16350's failure-propagation flow. These new Git commands—and the surrounding Yarn/add/init commands—can fail, but execution continues and a later successful command can overwrite %ERRORLEVEL%, making CLI generation report success after an incomplete app. Port the original if errorlevel 1 goto :failure checks and preserved EXIT_CODE cleanup.
  vnext/Scripts/creaternwlib.cmd:148
• This backport omits #16350's failure-propagation flow. These new Git commands—and the surrounding Yarn/add/init commands—can fail, but execution continues and a later successful command can overwrite %ERRORLEVEL%, making CLI generation report success after an incomplete library. Port the original if errorlevel 1 goto :failure checks and preserved EXIT_CODE cleanup.
  .ado/build-template.yml:603
• Restoring this deletion is required: this is the only inclusion of cli-init-windows.yml, so neither CI nor PR now runs CLI init verification. That contradicts this PR's backported CLI work and docs/build-pipelines.md:15,51-53, which still documents a CLI stage that validates the just-built packages.
  .ado/templates/publish-symbols.yml:17
• Symbol publication is a declared release target, but this setting converts authentication, service, or indexing failures into a successful release with missing symbols. Let the release fail so it cannot silently ship packages without the corresponding debugging artifacts.

  continueOnError: true