Port npm release pipeline fixes to main

[Adam Ratzman (adamint)]

Description

Ports the release/13.4 npm package publishing pipeline fixes from #18093 to main so the mainline release pipeline has the same npm validation and CLI package metadata behavior before the next release.

This updates the npm release pipeline to download validation summaries as build artifacts, validates npm ESRP owner/approver aliases through a shared script, and simplifies the npm publish skip parameters. It also moves CLI npm README content into templates and tests the pack script output directly.

Security considerations

The release pipeline now treats queue-time npm owners/approvers as environment data and validates aliases before emitting Azure Pipelines logging commands. The validation rejects non-Microsoft addresses, owner/approver overlap, missing required owners, and unsafe alias characters; I have not done a separate security review.

Fixes # (issue)

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 18164

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 18164"

[Copilot]

Pull request overview

This PR ports the npm release pipeline fixes from release/13.4 (#18093) to main, ensuring the mainline release pipeline has the same npm validation behavior and CLI package metadata improvements before the next release. The changes consolidate npm ESRP alias validation into a testable shared script, simplify the npm skip parameters by removing the coarser SkipNpmPublish and the override AllowNpmLatestDistTagMove, move README content into templates, and improve E2E test resilience to CLI self-update prompts.

Changes:

• Replaced SkipNpmPublish and AllowNpmLatestDistTagMove parameters with the granular SkipNpmRidPublish and SkipNpmPointerPublish flags, forwarding queue-time owner/approver values as environment variables for security.
• Extracted npm ESRP alias validation logic into eng/scripts/validate-npm-release-aliases.ps1 (mirrored inline in the pipeline YAML, with a sync test), and moved CLI npm README content from inline here-strings into template files.
• Added new tests exercising the pack script output directly, validating alias rejection scenarios, and handling the CLI self-update prompt in channel-update E2E tests.

Show a summary per file

File	Description
eng/scripts/validate-npm-release-aliases.ps1	New shared script for npm ESRP owner/approver validation with dot-source guard
eng/scripts/pack-cli-npm-package.ps1	Adds Read-TemplateFile / Expand-Template helpers, uses external README templates
eng/scripts/pack-cli-npm-package.rid.README.md	New RID-package README template with __PLACEHOLDER__ tokens
eng/scripts/pack-cli-npm-package.pointer.README.md	New pointer-package README template with install/update guidance
eng/pipelines/release-publish-nuget.yml	Removes SkipNpmPublish/AllowNpmLatestDistTagMove, uses DownloadBuildArtifacts@0, moves required owners to pipeline-level variable, env-block isolation for parameters
eng/pipelines/common-variables.yml	Removes NPM_PUBLISH_REQUIRED_OWNERS and NPM_PUBLISH_REQUIRED_APPROVERS (moved to release pipeline)
docs/specs/npm-cli-package.md	Updates spec to reflect new parameter names, validation approach, and env-var forwarding
tests/Infrastructure.Tests/PowerShellScripts/ValidateNpmReleaseAliasesTests.cs	New unit tests executing the validation script against sample inputs
tests/Infrastructure.Tests/Pipelines/ReleasePublishNugetPipelineTests.cs	Updated assertions for new parameter names, validation helpers, artifact downloads
tests/Infrastructure.Tests/Pipelines/NpmCliPackageTests.cs	New tests executing the pack script and verifying package.json/README output
tests/Shared/CliInstallStrategy.cs	New GetDotnetAddPackageCommand helper using local hive version with prerelease fallback
tests/Aspire.Cli.EndToEnd.Tests/Helpers/KubernetesDeployTestHelpers.cs	Uses new GetDotnetAddPackageCommand for API client packages
tests/Aspire.Cli.EndToEnd.Tests/Helpers/CliInstallStrategyTests.cs	Unit test for the new dotnet add package command helper
tests/Aspire.Cli.EndToEnd.Tests/ChannelUpdateWorkflowTests.cs	Handles CLI self-update prompt during stable-channel update preview
.gitignore	Adds extension/.test-workspace/ to ignored paths

Copilot's findings

• Files reviewed: 14/15 changed files
• Comments generated: 1

[Ankit Jain (radical)]

Adam Ratzman (@adamint) could you please list the differences from the PR to 13.4?

[Adam Ratzman (adamint)]

yep, differences from the 13.4 PR are:

• docs/release-process.md only exists on main, and it still referenced the removed SkipNpmPublish / AllowNpmLatestDistTagMove knobs, so I updated those instructions to the RID/pointer split.
• The npm pointer README TypeScript sample now uses the current generated TS AppHost shape (apphost.mts + ./.aspire/modules/aspire.mjs). The 13.4 PR had the older/mixed apphost.ts / aspire.js sample.
• ValidateNpmReleaseAliasesTests uses the existing main RepoRoot.Path helper instead of carrying the copied FindRepoRoot() from the 13.4 patch.
• Conflict-resolution only: main had VS Code extension publishing in release-publish-nuget.yml, extra common variables, and most of the new .gitignore entries already, so those were preserved rather than overwritten.

Everything else should be the same npm release behavior from #18093, adapted onto main.

[Copilot]

Copilot's findings

• Files reviewed: 15/16 changed files
• Comments generated: 0 new

[Ankit Jain (radical)]

Forward port of approved #18093 to main. Reviewed only the delta from the approved PR (assuming #18093's changes were already approved).

Delta verified:

• npm pointer README TS sample updated to the current generated shape (apphost.mts + ./.aspire/modules/aspire.mjs), confirmed against TypeScriptLanguageSupport.cs and the ts-starter/py-starter templates. NpmCliPackageTests assertions match and are falsifiable. This is more correct than the 13.4 sample.
• ValidateNpmReleaseAliasesTests uses the standard RepoRoot.Path helper instead of the copied FindRepoRoot().
• ReleasePublishNugetPipelineTests uses main's existing FindYamlVariableValue/FindYamlParameterDefault helpers; same values asserted (joperezr,ankj, adamratzman).
• release-publish-nuget.yml conflict-merge preserves all npm RID/pointer/validation-summary/signature logic; main-only additions are VS Code extension publishing. Final npm param block matches 13.4.

No npm behavior change vs the approved PR; no logic lost in the merge.