[release/13.4] Add Aspire CLI npm package release integration

.github/workflows/build-cli-native-archives.yml

@@ -53,6 +53,16 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      # Node.js is required because PackDotnetTool now depends on PackNpmPackage,
+      # which shells out to `npm pack` to produce the @microsoft/aspire-cli npm
+      # tarballs alongside the existing dotnet tool packages. GitHub-hosted
+      # runners ship Node by default, but installing it explicitly pins the
+      # version and avoids relying on the runner image.
+      - name: Install node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: 22.x
+
       # Build RID-specific NuGet packages (DCP + Dashboard) locally instead of
       # downloading them from the build_packages job. This allows the CLI archive
       # build to run in parallel with build_packages.
@@ -121,15 +131,33 @@ jobs:
             -Rid $rid `
             -ArchivePath $archive[0].FullName
 
-      # Upload DCP, Dashboard, and CLI tool NuGets so test/polyglot jobs can download them
-      - name: Upload RID-specific NuGets
+      - name: Verify CLI npm package
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+
+          $rid = '${{ matrix.targets.rids }}'
+          $archiveExtension = if ($rid.StartsWith('win-')) { 'zip' } else { 'tar.gz' }
+          $archive = @(Get-ChildItem -Path 'artifacts/packages/${{ inputs.configuration }}' -Filter "aspire-cli-$rid-*.$archiveExtension" -Recurse -File -ErrorAction SilentlyContinue)
+          if ($archive.Count -ne 1) {
+            throw "Expected exactly one CLI archive for $rid, but found $($archive.Count): $($archive.FullName -join ', ')"
+          }
+
+          eng/scripts/verify-cli-npm-package.ps1 `
+            -PackagesDir artifacts/packages/${{ inputs.configuration }} `
+            -Rid $rid `
+            -ArchivePath $archive[0].FullName
+
+      # Upload DCP, Dashboard, and CLI tool packages so test/polyglot jobs can download them
+      - name: Upload RID-specific packages
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: built-nugets-for-${{ matrix.targets.rids }}
           path: |
             artifacts/packages/${{ inputs.configuration }}/Shipping/Aspire.Hosting.Orchestration.${{ matrix.targets.rids }}.*.nupkg
             artifacts/packages/${{ inputs.configuration }}/Shipping/Aspire.Dashboard.Sdk.${{ matrix.targets.rids }}.*.nupkg
             artifacts/packages/${{ inputs.configuration }}/Shipping/Aspire.Cli.*.nupkg
+            artifacts/packages/${{ inputs.configuration }}/Shipping/microsoft-aspire-cli*.tgz
           if-no-files-found: error
           retention-days: 15
 

.github/workflows/tests.yml

@@ -312,6 +312,9 @@ jobs:
   extension_tests_win:
     name: Run VS Code extension tests (Windows)
     runs-on: windows-latest
+    env:
+      NPM_REGISTRY: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
+      COREPACK_ENABLE_DOWNLOAD_PROMPT: 0
     defaults:
       run:
         working-directory: ./extension
@@ -322,23 +325,126 @@ jobs:
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: '20.x'
+      - name: Install Corepack
+        run: |
+          # Scope Corepack's cache to this job so prepareCorepackYarn.mjs cannot
+          # collide with any other build sharing the runner's user profile.
+          # Cannot be set at job-level env: the `runner` context is unavailable
+          # in job env evaluation, so we forward it through $GITHUB_ENV instead.
+          $CorepackHome = Join-Path $env:RUNNER_TEMP 'corepack'
+          $env:COREPACK_HOME = $CorepackHome
+          "COREPACK_HOME=$CorepackHome" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+          $CorepackVersion = (Get-Content -Raw -Path 'scripts/corepack-version.txt').Trim()
+          # The hosted Windows image already has a yarn shim in npm's global
+          # prefix. The npm Corepack package owns that shim too, so force only
+          # in CI where the tool install is isolated to this ephemeral job.
+          npm install --global --force --registry "$env:NPM_REGISTRY" "corepack@$CorepackVersion"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+          $npmGlobalBin = (npm prefix --global).Trim()
+          $env:PATH = "$npmGlobalBin$([IO.Path]::PathSeparator)$env:PATH"
+          $npmGlobalBin | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+          $installed = (corepack --version).Trim()
+          if ($installed -ne $CorepackVersion) {
+            Write-Error "corepack version mismatch: expected $CorepackVersion, got '$installed'. The bundled Corepack on PATH may be taking precedence over the npm-global install."
+            exit 1
+          }
+
+          corepack enable
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+          # Seed Corepack's cache from the internal dnceng npm feed. Corepack's
+          # built-in `corepack prepare --activate` would download Yarn 1.x from
+          # registry.yarnpkg.com (hardcoded in Corepack 0.34's config.json and
+          # not redirectable via COREPACK_NPM_REGISTRY), bypassing the dnceng
+          # mirror this workflow is supposed to validate. The shared
+          # prepareCorepackYarn.mjs script does the equivalent via `npm pack`
+          # against $NPM_REGISTRY, then drops the same on-disk layout Corepack
+          # would have written.
+          node ./scripts/prepareCorepackYarn.mjs
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+          corepack yarn --version
       - name: Validate lockfile registries
-        run: node -e "const fs = require('fs'); const lock = fs.readFileSync('yarn.lock', 'utf8'); if (/registry\\.(?:npmjs\\.org|yarnpkg\\.com)/.test(lock)) { throw new Error('extension/yarn.lock contains public npm registry URLs. Regenerate it using the internal dotnet-public-npm feed before restoring.'); }"
+        # Allowlist scoped to lines starting with "resolved" (the only lines in
+        # yarn.lock that carry a tarball URL — `npm:` aliases don't).
+        # CONTRIBUTING.MD asks contributors to regenerate yarn.lock through the
+        # internal dotnet-public-npm feed; an allowlist catches drift to any
+        # other public mirror (npmmirror.com, jsr.io, github.com tarballs, ...)
+        # rather than only npmjs.org and yarnpkg.com.
+        run: |
+          node -e "const fs = require('fs'); const allow = 'pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm'; const bad = fs.readFileSync('yarn.lock', 'utf8').split(/\r?\n/).filter(l => /^\s*resolved\s+\x22/.test(l)).filter(l => !l.includes(allow)); if (bad.length) { throw new Error('extension/yarn.lock contains resolved entries outside the internal dotnet-public-npm feed. Regenerate it through the internal feed before restoring. First offender -> ' + bad[0]); }"
       - name: Install dependencies
-        run: yarn install --frozen-lockfile --non-interactive
+        run: corepack yarn install --frozen-lockfile --non-interactive
       - name: Run tests
-        run: yarn test
+        run: corepack yarn test
       - name: Override extension version for PR builds
         if: ${{ inputs.extensionVersionOverride != '' }}
-        run: yarn version --new-version "${{ inputs.extensionVersionOverride }}" --no-git-tag-version
+        run: corepack yarn version --new-version "${{ inputs.extensionVersionOverride }}" --no-git-tag-version
       - name: Package VSIX
-        run: yarn run vsce package --pre-release -o out/aspire-extension.vsix
+        run: corepack yarn run vsce package --pre-release -o out/aspire-extension.vsix
       - name: Upload VSIX
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: aspire-extension
           path: extension/out/aspire-extension.vsix
 
+  extension_bootstrap_linux:
+    name: Validate VS Code extension bootstrap (Linux)
+    # Without this, the non-Windows code paths in
+    # extension/scripts/prepareCorepackYarn.mjs (npm invocation that does not go
+    # through node.exe, POSIX tar) are only exercised on contributor machines
+    # and never on a fresh CI image. extension_tests_win covers the Windows
+    # paths; this job covers Linux/macOS. macOS is omitted because the only
+    # platform-specific branch beyond Linux is the cache path, which is
+    # explicitly overridden via COREPACK_HOME in the build entrypoints.
+    runs-on: ubuntu-latest
+    env:
+      NPM_REGISTRY: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
+      COREPACK_ENABLE_DOWNLOAD_PROMPT: 0
+    defaults:
+      run:
+        working-directory: ./extension
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: '20.x'
+      - name: Install Corepack
+        run: |
+          set -euo pipefail
+          # Scope Corepack's cache to this job. Set via $GITHUB_ENV because the
+          # `runner` context is not available in job-level env evaluation.
+          export COREPACK_HOME="$RUNNER_TEMP/corepack"
+          echo "COREPACK_HOME=$COREPACK_HOME" >> "$GITHUB_ENV"
+
+          CorepackVersion="$(tr -d '[:space:]' < scripts/corepack-version.txt)"
+          npm install --global --force --registry "$NPM_REGISTRY" "corepack@${CorepackVersion}"
+
+          installed="$(corepack --version 2>/dev/null || true)"
+          if [ "$installed" != "$CorepackVersion" ]; then
+            echo "corepack version mismatch: expected $CorepackVersion, got '$installed'. The bundled Corepack on PATH may be taking precedence over the npm-global install."
+            exit 1
+          fi
+
+          corepack enable
+      - name: Seed Corepack Yarn cache via prepareCorepackYarn.mjs
+        # Exercises the script's non-Windows branches against a clean cache
+        # directory. Failing here means a contributor on Linux/macOS following
+        # CONTRIBUTING.MD would also be broken.
+        run: node ./scripts/prepareCorepackYarn.mjs
+      - name: Validate lockfile registries
+        # Mirror of the same allowlist guard in extension_tests_win so this
+        # cross-platform bootstrap also catches drift to a public-registry URL.
+        run: |
+          node -e "const fs = require('fs'); const allow = 'pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm'; const bad = fs.readFileSync('yarn.lock', 'utf8').split(/\r?\n/).filter(l => /^\s*resolved\s+\x22/.test(l)).filter(l => !l.includes(allow)); if (bad.length) { throw new Error('extension/yarn.lock contains resolved entries outside the internal dotnet-public-npm feed. Regenerate it through the internal feed before restoring. First offender -> ' + bad[0]); }"
+      - name: Validate seeded cache via yarn install
+        run: corepack yarn install --frozen-lockfile --non-interactive
+
   typescript_sdk_tests:
     name: TypeScript SDK Unit Tests
     uses: ./.github/workflows/typescript-sdk-tests.yml
@@ -364,6 +470,7 @@ jobs:
       prepare_homebrew_installer_artifacts,
       build_cli_e2e_image,
       extension_tests_win,
+      extension_bootstrap_linux,
       cli_starter_validation_windows,
       typescript_sdk_tests,
       typescript_api_compat,

.gitignore

@@ -197,6 +197,7 @@ extension/dist/
 extension/.localization/
 extension/out/
 extension/node_modules/
+extension/.corepack-cache/
 **/.vscode-test/
 extension/.version