Add ESRP release API helper

[ecraig12345]

See packages/esrp-npm-release/README.md for how it works.

[Copilot]

Pull request overview

Adds a private ESRP npm release helper package and wires the Beachball release pipelines to publish packed dependency layers through the ESRP Release API instead of the existing ESRP task.

Changes:

• Adds @microsoft/esrp-npm-release with ESRP HTTP helpers, AAD auth, JWS signing, Azure Blob staging, persisted release state, docs, and tests.
• Updates ADO publish/release pipelines to produce packed package/tool artifacts and run the new helper.
• Adds supporting Yarn plugin/patches, Azure staging infrastructure Bicep, and dependency lockfile updates.

Reviewed changes

Copilot reviewed 46 out of 48 changed files in this pull request and generated 19 comments.

Show a summary per file

File	Description
yarn.lock	Adds workspace and dependency resolutions for the new helper.
scripts/bundleNode.ts	Adjusts bundling notice handling.
packages/esrp-npm-release/tsconfig.test.json	Adds test TypeScript config.
packages/esrp-npm-release/tsconfig.json	Adds package TypeScript config.
packages/esrp-npm-release/src/utils/signing.ts	Adds PFX/certificate extraction and thumbprint helpers.
packages/esrp-npm-release/src/utils/releaseHttp.ts	Adds ESRP release API HTTP helpers.
packages/esrp-npm-release/src/utils/ReleaseError.ts	Adds custom release error type.
packages/esrp-npm-release/src/utils/Logger.ts	Adds ADO-aware logger.
packages/esrp-npm-release/src/utils/hashFileStream.ts	Adds streaming SHA-256 file hashing.
packages/esrp-npm-release/src/utils/getAadToken.ts	Adds MSAL token acquisition helper.
packages/esrp-npm-release/src/utils/generateJwsToken.ts	Adds ESRP JWS request signing.
packages/esrp-npm-release/src/runRelease.ts	Orchestrates layer zipping, staging, release, and state updates.
packages/esrp-npm-release/src/ReleaseState.ts	Persists published-layer markers in Blob Storage.
packages/esrp-npm-release/src/models/types.ts	Adds ESRP API model types.
packages/esrp-npm-release/src/models/npmRelease.ts	Builds npm release request payloads.
packages/esrp-npm-release/src/index.ts	Adds CLI entrypoint.
packages/esrp-npm-release/src/getEnvOptions.ts	Reads release configuration from environment variables.
packages/esrp-npm-release/src/ESRPReleaseService.ts	Implements staging, SAS generation, submit, poll, and cleanup flow.
packages/esrp-npm-release/src/__tests__/signing.test.ts	Tests signing utilities.
packages/esrp-npm-release/src/__tests__/runRelease.test.ts	Tests release orchestration.
packages/esrp-npm-release/src/__tests__/ReleaseState.test.ts	Tests persisted release state behavior.
packages/esrp-npm-release/src/__tests__/releaseHttp.test.ts	Tests ESRP HTTP helpers.
packages/esrp-npm-release/src/__tests__/npmRelease.test.ts	Tests npm release request creation and redaction.
packages/esrp-npm-release/src/__tests__/hashFileStream.test.ts	Tests streaming file hashing.
packages/esrp-npm-release/src/__tests__/getEnvOptions.test.ts	Tests environment parsing.
packages/esrp-npm-release/src/__tests__/getAadToken.test.ts	Tests AAD token helper behavior.
packages/esrp-npm-release/src/__tests__/generateJwsToken.test.ts	Tests JWS token generation.
packages/esrp-npm-release/src/__tests__/ESRPReleaseService.test.ts	Tests ESRP service orchestration.
packages/esrp-npm-release/src/__fixtures__/testCert.ts	Adds OpenSSL-generated certificate fixtures.
packages/esrp-npm-release/src/__fixtures__/tempDir.ts	Adds temp directory test helpers.
packages/esrp-npm-release/src/__fixtures__/MockLogger.ts	Adds capturing logger test double.
packages/esrp-npm-release/src/__fixtures__/mockEsrpHttp.ts	Adds mocked ESRP HTTP module.
packages/esrp-npm-release/src/__fixtures__/mockEnv.ts	Adds environment option fixtures.
packages/esrp-npm-release/src/__fixtures__/mockAzure.ts	Adds Azure Blob Storage mocks.
packages/esrp-npm-release/README.md	Documents setup and pipeline usage.
packages/esrp-npm-release/package.json	Defines package metadata, scripts, and dependencies.
packages/esrp-npm-release/jest.config.cjs	Adds Jest config.
packages/esrp-npm-release/eslint.config.js	Adds package lint rules.
packages/esrp-npm-release/.depcheckrc.yml	Adds depcheck ignores.
.yarnrc.yml	Adds Yarn npmrc plugin configuration.
.yarn/plugins/@yarnpkg/plugin-npmrc.cjs	Vendors Yarn npmrc auth plugin.
.yarn/patches/jws-npm-4.0.1-0d8c257cbe.patch	Patches jws BigInt serialization.
.prettierignore	Ignores Bicep files.
.gitignore	Allows committed Yarn plugins.
.ado/roleAssignments.bicep	Adds staging storage and RBAC infrastructure.
.ado/release.yml	Updates release pipeline to run the helper.
.ado/publish.yml	Updates prepublish pipeline artifacts and registry setup.

Comments suppressed due to low confidence (2)

packages/esrp-npm-release/jest.config.cjs:9

• This config switches the transformer to ts-jest, but ts-jest is not declared anywhere in the workspace dependencies or lockfile. Running this package's tests will fail during Jest config resolution unless the dependency is added or the existing babel-jest ESM helper is used.
  packages/esrp-npm-release/README.md:98
• This second deployment command has the same path issue: the Bicep file is added under .ado/roleAssignments.bicep, not at roleAssignments.bicep in the repository root.

az deployment group create \
  --subscription "$SUBSCRIPTION" \
  --resource-group "$RESOURCE_GROUP" \
  --template-file roleAssignments.bicep \
  --parameters \
    stagingStorageName="$STORAGE_ACCOUNT" \

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ecraig12345]

@copilot When polling for release status, add a specific check for 404 error details in the message errorInfo, and use a custom message similar to the E404 handling in beachball

Release has failed ErrorMessage : Release failed due to activity failure.,Failed Activity : Package Manager., ErrorCode : 2201. {"code":null,"details":{"errors:":"404 Not Found - PUT https://registry.npmjs.org/@microsoft%2fado-npm-auth-lib - Not found"},"innerError":null}

[Copilot]

@copilot When polling for release status, add a specific check for 404 error details in the message errorInfo, and use a custom message similar to the E404 handling in beachball

Release has faile...

Implemented in e7493e8: status polling now inspects ESRP errorInfo/errorinfo details for npm registry 404 Not Found - PUT https://registry.npmjs.org/... and throws a custom auth-focused E404 message aligned with beachball’s handling. Also added a unit test covering this case in ESRPReleaseService.test.ts. No UI changes (CLI-only), so no screenshot applies.