Fix NPM dist tags and make some NPM private (#15416)

Author: vmoroz

.ado/publish.yml

@@ -211,53 +211,6 @@ extends:
           - script: dir /s "$(Pipeline.Workspace)\published-packages"
             displayName: Show created npm packages
 
-          # Beachball usually takes care about the NPM package tagging based on the values in package.json files.
-          # We use the ESRP Release where we must provide the tag explictly (the productstate parameter).
-          # Fortunately, we just use two tags: latest and some custom tag like "canary", "v0.73-stable", etc.
-          # The npmGroupByTag.js script groups the created NPM package by these two tags into the specified folders.
-          - pwsh: |
-              node .ado/scripts/npmGroupByTag.js "$(Pipeline.Workspace)\published-packages" "$(Pipeline.Workspace)\published-packages\custom-tag" "$(Pipeline.Workspace)\published-packages\latest-tag"
-            displayName: Group npm packages by tag
-
-          - script: dir /s "$(Pipeline.Workspace)\published-packages"
-            displayName: Show grouped npm packages by tag
-
-          # Publish NPM packages using ESRP Release task with the custom tag such as "canary", "v0.73-stable", etc.
-          - task: 'SFP.release-tasks.custom-build-release-task.EsrpRelease@10'
-            displayName: 'ESRP Release to npmjs.com (custom tag)'
-            condition: and(succeeded(), ${{ not(parameters.skipNpmPublish) }}, eq(variables['NpmCustomFolderHasContent'], 'true'))
-            inputs:
-              connectedservicename: 'ESRP-CodeSigning-OGX-JSHost-RNW'
-              usemanagedidentity: false
-              keyvaultname: 'OGX-JSHost-KV'
-              authcertname: 'OGX-JSHost-Auth4'
-              signcertname: 'OGX-JSHost-Sign3'
-              clientid: '0a35e01f-eadf-420a-a2bf-def002ba898d'
-              domaintenantid: 'cdc5aeea-15c5-4db6-b079-fcadd2505dc2'
-              contenttype: npm
-              folderlocation: '$(NpmCustomFolder)'
-              productstate: '$(NpmCustomTag)'
-              owners: '[email protected]'
-              approvers: '[email protected]'
-
-          # Publish NPM packages using ESRP Release task with the "latest" tag.
-          - task: 'SFP.release-tasks.custom-build-release-task.EsrpRelease@10'
-            displayName: 'ESRP Release to npmjs.com (latest)'
-            condition: and(succeeded(), ${{ not(parameters.skipNpmPublish) }}, eq(variables['NpmLatestFolderHasContent'], 'true'))
-            inputs:
-              connectedservicename: 'ESRP-CodeSigning-OGX-JSHost-RNW'
-              usemanagedidentity: false
-              keyvaultname: 'OGX-JSHost-KV'
-              authcertname: 'OGX-JSHost-Auth4'
-              signcertname: 'OGX-JSHost-Sign3'
-              clientid: '0a35e01f-eadf-420a-a2bf-def002ba898d'
-              domaintenantid: 'cdc5aeea-15c5-4db6-b079-fcadd2505dc2'
-              contenttype: npm
-              folderlocation: '$(NpmLatestFolder)'
-              productstate: 'latest'
-              owners: '[email protected]'
-              approvers: '[email protected]'
-
           # Beachball reverts to local state after publish, but we want the updates it added
           - script: git pull origin $(SourceBranchWithFolders)
             displayName: git pull

.ado/release.yml

@@ -26,12 +26,51 @@ extends:
     customBuildTags:
     - ES365AIMigrationTooling-Release
     stages:
-    - stage: PushToPrivateAdoStage
-      displayName: ADO - react-native
+    - stage: Release
+      displayName: Publish artifacts
       jobs:
-      - job: PushPackages
-        displayName: Push packages
-        condition: succeeded()
+      - job: PushNpm
+        displayName: npmjs.com - Publish npm packages
+        variables:
+        - group: RNW Secrets
+        timeoutInMinutes: 0
+        templateContext:
+          inputs:
+          - input: pipelineArtifact
+            pipeline: 'Publish'
+            artifactName: 'NpmPackedTarballs'
+            targetPath: '$(Pipeline.Workspace)/published-packages'
+          - input: pipelineArtifact
+            pipeline: 'Publish'
+            artifactName: 'VersionEnvVars'
+            targetPath: '$(Pipeline.Workspace)/VersionEnvVars'
+        steps:
+        - checkout: none
+        - task: CmdLine@2
+          displayName: Apply version variables
+          inputs:
+            script: node $(Pipeline.Workspace)/VersionEnvVars/versionEnvVars.js
+        - script: dir /s "$(Pipeline.Workspace)\published-packages"
+          displayName: Show npm packages
+        - task: 'SFP.release-tasks.custom-build-release-task.EsrpRelease@10'
+          displayName: 'ESRP Release to npmjs.com'
+          condition: and(succeeded(), ne(variables['NpmDistTag'], ''))
+          inputs:
+            connectedservicename: 'ESRP-CodeSigning-OGX-JSHost-RNW'
+            usemanagedidentity: false
+            keyvaultname: 'OGX-JSHost-KV'
+            authcertname: 'OGX-JSHost-Auth4'
+            signcertname: 'OGX-JSHost-Sign3'
+            clientid: '0a35e01f-eadf-420a-a2bf-def002ba898d'
+            domaintenantid: 'cdc5aeea-15c5-4db6-b079-fcadd2505dc2'
+            contenttype: npm
+            folderlocation: '$(Pipeline.Workspace)\published-packages'
+            productstate: '$(NpmDistTag)'
+            owners: '[email protected]'
+            approvers: '[email protected]'
+
+      - job: PushPrivateAdo
+        displayName: ADO - react-native
         timeoutInMinutes: 0
         templateContext:
           inputs:
@@ -52,12 +91,9 @@ extends:
           inputs:
             script: nuget.exe push *.nupkg -ApiKey AzureArtifacts -Source https://pkgs.dev.azure.com/ms/_packaging/react-native/nuget/v3/index.json -NonInteractive -Verbosity Detailed -SkipDuplicate -NoSymbols
             workingDirectory: $(Pipeline.Workspace)/ReactWindows-final-nuget
-    - stage: PushToPublicAdoStage
-      displayName: ADO - react-native-public
-      jobs:
-      - job: PushPackages
-        displayName: Push packages
-        condition: succeeded()
+
+      - job: PushPublicAdo
+        displayName: ADO - react-native-public
         timeoutInMinutes: 0
         templateContext:
           inputs:
@@ -78,13 +114,11 @@ extends:
           inputs:
             script: nuget.exe push *.nupkg -ApiKey AzureArtifacts -Source https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/nuget/v3/index.json -NonInteractive -Verbosity Detailed -SkipDuplicate -NoSymbols
             workingDirectory: $(Pipeline.Workspace)/ReactWindows-final-nuget
-    - stage: PushToNuGetStage
-      displayName: nuget.org - Push nuget packages
-      variables:
-      - group: RNW Secrets
-      jobs:
-      - job: PushPackages
-        displayName: Push packages
+
+      - job: PushNuGetOrg
+        displayName: nuget.org - Push nuget packages
+        variables:
+        - group: RNW Secrets
         timeoutInMinutes: 0
         templateContext:
           inputs: