Address Copilot comments for PR #16379

[Vladimir Morozov (vmoroz)]

Description

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• Automation (AI changes or Github Actions to reduce effort of manual tasks)

Why

Follow-up to #16379 (merged) that addresses the code-review feedback left on it.
The feed-warmer could finish "successfully" while having warmed nothing, the
scheduled pipeline passed a queue-time value straight into a PowerShell script,
the warmer package had no unit tests, and two byte-identical copies of the warm
pipeline had drifted into the repo. This PR resolves those.

Resolves review feedback on #16379.

What

Feed-warmer now fails loudly instead of silently. Feed enumeration and the
npm/NuGet registry lookups throw on 5xx/malformed/auth responses instead of
treating them as "empty"; package-expansion failures propagate instead of being
swallowed; a version that still 404s after all retries fails the run; and an
invalid --only value exits non-zero. A scheduled run that warms nothing now
fails visibly — which is the entire point of the reliability job.

Pipeline command-injection hardening. The one-off packages queue-time
parameter is handed to the warm step through an environment variable instead of
being interpolated into the PowerShell script body, so a queued value can no
longer inject commands under the feed's managed identity.

One warm pipeline, not two. Removed the duplicate warm-feed-cache-pipeline.yml
(byte-identical to warm-feed-pipeline.yml) and pointed the docs at the single
canonical file, so there is one source of truth and no risk of duplicate runs.

Unit tests for the warmer. Added a focused jest suite — version parse/compare,
line-expansion modes, one-off CLI parsing, and HTTP-failure propagation — wired
through the standard rnw-scripts test, so yarn test now exercises the package.

Tester image example. The two inline data-URI images in the Image example are
now distinct, so the multi-source / srcSet / density examples once again show
which candidate React Native actually selected.

Screenshots

N/A — pipeline, tooling, and test changes.

Testing

Added a jest unit suite for the feed-warmer covering the version, expansion, CLI,
and HTTP-failure paths; yarn test is green locally (build, lint, and prettier
also clean).

Changelog

Should this change be included in the release notes: no

CI/tooling hardening for the feed-warmer and its pipeline; no shipping-package change.

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

Hardens feed-warming reliability, security, and test coverage following PR #16379.

Changes:

• Improves registry, enumeration, and warming failure handling.
• Adds Jest coverage for warmer behavior.
• Secures and consolidates the pipeline; updates documentation and image examples.

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.ado/README.md	Updates canonical pipeline documentation.
.ado/warm-feed-cache-pipeline.yml	Removes duplicate pipeline.
.ado/warm-feed-pipeline.yml	Passes queue input through an environment variable.
packages/@react-native/tester/js/examples/Image/ImageExample.js	Makes inline test images distinct.
packages/@rnw-scripts/warm-feed/jest.config.js	Configures Jest.
packages/@rnw-scripts/warm-feed/package.json	Adds test script and dependencies.
packages/@rnw-scripts/warm-feed/src/feedPackages.ts	Hardens feed enumeration errors.
packages/@rnw-scripts/warm-feed/src/registries.ts	Hardens registry response handling.
packages/@rnw-scripts/warm-feed/src/run.ts	Propagates failures and validates options.
packages/@rnw-scripts/warm-feed/src/test/expand.test.ts	Tests package expansion modes.
packages/@rnw-scripts/warm-feed/src/test/feedPackages.test.ts	Tests feed enumeration behavior.
packages/@rnw-scripts/warm-feed/src/test/parseSpec.test.ts	Tests one-off package parsing.
packages/@rnw-scripts/warm-feed/src/test/registries.test.ts	Tests registry responses.
packages/@rnw-scripts/warm-feed/src/test/versions.test.ts	Tests version parsing and comparison.
yarn.lock	Locks new test dependencies.

Suppressed comments (1)

packages/@rnw-scripts/warm-feed/src/registries.ts:152

• A 200 response with {} is still cached as an empty version list, even though the new comment and PR contract say malformed indexes must throw. Since fetchJson does no runtime shape validation, require body.versions to be an array before caching it.

      // A 5xx or malformed index must not be cached as an empty version list.
      if (status < 200 || status >= 300 || !body) {
        throw new Error(
          `NuGet version fetch failed (status ${status}) for ${id}`,
        );
      }
      const versions = body.versions ?? [];

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated no new comments.