Fix CI pipeline and add warn-feed script

.ado/image/rnw-img-vs2026-node24.json

@@ -21,6 +21,9 @@
         {
             "name": "windows-gitinstall"
         },
+        {
+            "name": "windows-git-lfs"
+        },
         {
             "name": "windows-AzPipeline-ImageHelpers"
         },
@@ -33,18 +36,32 @@
         {
             "name": "windows-AzPipeline-7zip"
         },
+        {
+            "name": "windows-chocolatey",
+            "parameters": {
+                "packages": "nasm"
+            }
+        },
         {
             "name": "windows-visualstudio-bootstrapper",
             "parameters": {
-                "Workloads": "--add Microsoft.VisualStudio.Workload.ManagedDesktop --add Microsoft.VisualStudio.Workload.NativeDesktop --add Microsoft.VisualStudio.Workload.Universal --add Microsoft.VisualStudio.ComponentGroup.NativeDesktop.Core --add Microsoft.VisualStudio.ComponentGroup.UWP.Support --add Microsoft.VisualStudio.ComponentGroup.UWP.VC --add Microsoft.Component.MSBuild --add Microsoft.VisualStudio.Component.VC.Tools.x86.x64 --add Microsoft.VisualStudio.Component.Windows11SDK.22621 --includeRecommended --includeOptional",
+                "Workloads": "--add Microsoft.VisualStudio.Workload.ManagedDesktop --add Microsoft.VisualStudio.Workload.NativeDesktop --add Microsoft.VisualStudio.Workload.Universal --add Microsoft.VisualStudio.ComponentGroup.NativeDesktop.Core --add Microsoft.VisualStudio.ComponentGroup.UWP.Support --add Microsoft.VisualStudio.ComponentGroup.UWP.VC --add Microsoft.Component.MSBuild --add Microsoft.VisualStudio.Component.VC.CoreBuildTools --add Microsoft.VisualStudio.Component.VC.CoreIde --add Microsoft.VisualStudio.Component.VC.Tools.x86.x64 --add Microsoft.VisualStudio.Component.VC.Tools.ARM64 --add Microsoft.VisualStudio.Component.VC.Llvm.Clang --add Microsoft.VisualStudio.Component.VC.Llvm.ClangToolset --add Microsoft.VisualStudio.Component.VC.CMake.Project --add Microsoft.VisualStudio.Component.Windows11SDK.26100 --add Microsoft.VisualStudio.Component.Windows11Sdk.WindowsPerformanceToolkit --add Microsoft.VisualStudio.Component.Windows11SDK.22621 --add Microsoft.VisualStudio.Component.VC.ATL --add Microsoft.VisualStudio.Component.VC.ATL.ARM64 --add Microsoft.VisualStudio.Component.VC.ATLMFC --add Microsoft.VisualStudio.Component.VC.MFC.ARM64 --add Microsoft.VisualStudio.Component.UWP.VC.ARM64 --add Microsoft.VisualStudio.Component.VC.Runtimes.x86.x64.Spectre --add Microsoft.VisualStudio.Component.VC.Runtimes.ARM64.Spectre --add Microsoft.VisualStudio.Component.VC.ATL.Spectre --add Microsoft.VisualStudio.Component.VC.ATL.ARM64.Spectre --includeRecommended --includeOptional",
                 "SKU": "Enterprise",
                 "VSBootstrapperURL": "https://aka.ms/vs/18/stable/vs_Enterprise.exe"
             }
         },
         {
             "name": "Windows-NodeJS",
             "parameters": {
-                "Version": "24.16.0"
+                "Version": "24.x",
+                "UseARM": "false"
+            }
+        },
+        {
+            "name": "windows-install-python",
+            "parameters": {
+                "Version": "latest",
+                "Architecture": "x64"
             }
         },
         {
@@ -56,11 +73,36 @@
         {
             "name": "windows-dotnetcore-sdk",
             "parameters": {
-                "DotNetCoreVersion": "10.0.300"
+                "DotNetCoreVersion": "latest",
+                "Channel": "10.0"
+            }
+        },
+        {
+            "name": "windows-1es-pt-prerequisites-v2",
+            "parameters": {
+                "KVSecret_AppSecret": "https://pipelinesidentity.vault.azure.net/secrets/1es-gpt-read-only-app-secret"
             }
         },
         {
             "name": "Windows-AzureCLI"
+        },
+        {
+            "name": "windows-updateregistry",
+            "parameters": {
+                "RegistryPath": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\VisualStudio\\Setup",
+                "RegistryKey": "BackgroundDownloadDisabled",
+                "DataType": "REG_DWORD",
+                "Value": "1"
+            }
+        },
+        {
+            "name": "windows-updateregistry",
+            "parameters": {
+                "RegistryPath": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\VisualStudio\\Setup",
+                "RegistryKey": "BackgroundDownloadDisabled",
+                "DataType": "REG_DWORD",
+                "Value": "1"
+            }
         }
     ]
 }

.ado/release-pipeline.yml

@@ -229,6 +229,42 @@ extends:
             owners: 'vmorozov@microsoft.com'
             approvers: 'khosany@microsoft.com'
 
+      - job: PushNpmPublicAdo
+        displayName: ADO - npm - react-native-public
+        timeoutInMinutes: 30
+        templateContext:
+          type: releaseJob
+          isProduction: true
+          inputs:
+          - input: pipelineArtifact
+            pipeline: 'CI'
+            artifactName: 'NpmPackedTarballs'
+            targetPath: '$(Pipeline.Workspace)/npm-feed-packages'
+        steps:
+        - template: .ado/templates/publish-npm-to-ado-feed.yml@self
+          parameters:
+            npmFeedRegistry: 'https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/'
+            packagesPath: '$(Pipeline.Workspace)/npm-feed-packages'
+            feedDisplayName: 'ms/react-native-public'
+
+      - job: PushNpmPrivateAdo
+        displayName: ADO - npm - react-native
+        timeoutInMinutes: 30
+        templateContext:
+          type: releaseJob
+          isProduction: true
+          inputs:
+          - input: pipelineArtifact
+            pipeline: 'CI'
+            artifactName: 'NpmPackedTarballs'
+            targetPath: '$(Pipeline.Workspace)/npm-feed-packages'
+        steps:
+        - template: .ado/templates/publish-npm-to-ado-feed.yml@self
+          parameters:
+            npmFeedRegistry: 'https://pkgs.dev.azure.com/ms/_packaging/react-native/npm/registry/'
+            packagesPath: '$(Pipeline.Workspace)/npm-feed-packages'
+            feedDisplayName: 'ms/react-native'
+
       - job: PushPrivateAdo
         displayName: ADO - nuget - react-native
         timeoutInMinutes: 30

.ado/templates/msbuild-sln.yml

@@ -47,7 +47,6 @@ steps:
         /p:PlatformToolset=${{parameters.platformToolset}}
         /p:PublishToolDuringBuild=true
         /p:RestoreLockedMode=true
-        /p:RestoreForceEvaluate=true
         /bl:$(BuildLogDirectory)\MsBuild.binlog
         /flp1:errorsonly;logfile=$(BuildLogDirectory)\MsBuild.err.log
         /flp2:warningsonly;logfile=$(BuildLogDirectory)\MsBuild.wrn.log

.ado/templates/prepare-build-env.yml

@@ -31,15 +31,15 @@ parameters:
     # invoked. Example: ['RNTesterApp-Fabric', 'Playground'].
 
 steps:
-  # The VS Installer's background auto-update service otherwise wakes up mid-build and
-  # downloads VS updates from the MS CDN, which trips the network isolation policy.
-  # Follow-up: bake this into the agent image so it doesn't have to run per job.
+  # VS Installer's background auto-update (BackgroundDownload.exe) fetches VS updates from the MS
+  # CDN mid-build and trips network isolation. Interim belt; the durable fix is BackgroundDownloadDisabled=1
+  # baked into the agent image JSON (.ado/image/rnw-img-vs2026-node24.json) — remove once that image ships.
   - pwsh: |
       foreach ($key in @(
           'HKLM:\SOFTWARE\Microsoft\VisualStudio\Setup',
           'HKLM:\SOFTWARE\Policies\Microsoft\VisualStudio\Setup')) {
         New-Item -Path $key -Force | Out-Null
-        New-ItemProperty -Path $key -Name BackgroundDownload -PropertyType DWord -Value 0 -Force | Out-Null
+        New-ItemProperty -Path $key -Name BackgroundDownloadDisabled -PropertyType DWord -Value 1 -Force | Out-Null
       }
       Get-Process -Name BackgroundDownload -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
     displayName: Disable VS Installer background download

.ado/templates/publish-npm-to-ado-feed.yml

@@ -0,0 +1,51 @@
+# Publishes packed npm tarballs to an Azure Artifacts feed's npm registry, mirroring
+# publish-nuget-to-ado-feed.yml. Auth uses the shared managed identity (same identity/
+# resource the NuGet feed publish uses).
+parameters:
+- name: azureSubscription
+  type: string
+  default: 'Office-Hermes-Windows-Bot'
+- name: npmFeedRegistry
+  type: string
+- name: packagesPath
+  type: string
+- name: feedDisplayName
+  type: string
+
+steps:
+- task: AzureCLI@2
+  displayName: Acquire ${{ parameters.feedDisplayName }} feed token
+  inputs:
+    azureSubscription: ${{ parameters.azureSubscription }}
+    visibleAzLogin: false
+    scriptType: pscore
+    scriptLocation: inlineScript
+    inlineScript: |
+      $token = az account get-access-token --query accessToken --resource 499b84ac-1321-427f-aa17-267ca6975798 -o tsv
+      if ([string]::IsNullOrWhiteSpace($token)) { throw 'Failed to acquire a feed access token.' }
+      Write-Host "##vso[task.setsecret]$token"
+      Write-Host "##vso[task.setvariable variable=AdoNpmFeedToken;issecret=true]$token"
+
+- pwsh: |
+    # The .npmrc holds only the ${NPM_FEED_TOKEN} placeholder; npm expands it from the masked env
+    # var at run time, so the raw token never lands in a file. A version already present in the feed
+    # (locally or via its npmjs upstream) returns 409, which we treat as success.
+    $registry = '${{ parameters.npmFeedRegistry }}'
+    $key = ($registry -replace '^https?:', '')
+    Set-Content -Path (Join-Path $env:USERPROFILE '.npmrc') -Encoding ascii -Value @(
+      "registry=$registry"
+      "${key}:_authToken=`${NPM_FEED_TOKEN}"
+    )
+    $tgzs = @(Get-ChildItem -Path '${{ parameters.packagesPath }}' -Filter *.tgz -Recurse)
+    Write-Host "Publishing $($tgzs.Count) package(s) to ${{ parameters.feedDisplayName }}"
+    $failed = @()
+    foreach ($tgz in $tgzs) {
+      $out = & npm publish $tgz.FullName --registry $registry 2>&1 | Out-String
+      if ($LASTEXITCODE -eq 0) { Write-Host "published $($tgz.Name)" }
+      elseif ($out -match 'already exists|EPUBLISHCONFLICT|cannot publish over|\b409\b') { Write-Host "skipped (already in feed): $($tgz.Name)" }
+      else { Write-Host "##[error]Failed to publish $($tgz.Name): $out"; $failed += $tgz.Name }
+    }
+    if ($failed.Count -gt 0) { throw "Failed to publish $($failed.Count) package(s) to ${{ parameters.feedDisplayName }}." }
+  displayName: Publish npm packages to ${{ parameters.feedDisplayName }}
+  env:
+    NPM_FEED_TOKEN: $(AdoNpmFeedToken)

.ado/templates/run-windows-with-certificates.yml

@@ -24,7 +24,7 @@ parameters:
     default: true
   - name: restoreForceEvaluate
     type: boolean
-    default: true
+    default: false
   - name: errorOnNuGetLockChanges
     type: boolean
     default : true

.ado/warm-feed-cache-pipeline.yml

@@ -1,81 +1,100 @@
+# Scheduled feed-warming pipeline (office/ISS).
 #
-# Scheduled feed-warming pipeline (office/ISS, non-production).
-#
-# Runs Warm-RnwFeedCache.ps1 to save the CLI-init toolchain closure into the
-# ms/react-native-public feed with an authenticated identity, so anonymous PR
-# builds restore cleanly instead of 404ing on a not-yet-cached transitive package.
-#
-# Runs every 6 hours; drop to hourly later if it stays light.
+# Enumerates the ms/react-native-public feed and re-pulls, with the pipeline's
+# managed identity, the latest patch of every npm/NuGet major.minor line already
+# in use, so anonymous network-isolated PR/CI builds can restore them.
 #
+# Runs out of band (never in a PR build) because saving into the feed needs the
+# managed identity. A maintainer can also queue it with the `packages` parameter
+# to warm a specific set of versions on demand.
 
-name: 0.0.$(Date:yyMM.d)$(Rev:rrr)
+name: $(Date:yyyyMMdd).$(Rev:r)
 
 trigger: none
 pr: none
 
+parameters:
+  - name: packages
+    displayName: 'One-off warm (space-separated): npm:foo@1.2.3 nuget:Bar@4.0.0'
+    type: string
+    default: ' '
+
 schedules:
-  - cron: "0 0,6,12,18 * * *"
+  - cron: '0 0,6,12,18 * * *'
     displayName: Every 6 hours
     branches:
       include:
         - main
     always: true
 
+# Route npm/Yarn/NuGet through the ms/react-native-public feed (matches CI) under network isolation.
+variables:
+  - template: variables/shared.yml
+
 resources:
   repositories:
-  - repository: OfficePipelineTemplates
-    type: git
-    name: 1ESPipelineTemplates/OfficePipelineTemplates
-    ref: refs/tags/release
+    - repository: OfficePipelineTemplates
+      type: git
+      name: 1ESPipelineTemplates/OfficePipelineTemplates
+      ref: refs/tags/release
 
 extends:
   template: v1/Office.Unofficial.PipelineTemplate.yml@OfficePipelineTemplates
   parameters:
     pool:
-      name: fabric-internal-pool-large
-      demands: ImageOverride -equals rnw-img-vs2026-node24
+      name: Azure-Pipelines-1ESPT-ExDShared
+      vmImage: windows-latest
+      os: windows
     sdl:
       bandit:
         enabled: false
+      # Skip ESLint SDL on this utility pipeline (CI/Release run it on the code); the Unofficial
+      # template's --exit-on-fatal-error trips on repo-wide Guardian ES5-parser parse noise.
       eslint:
-        enableExclusions: true
+        enabled: false
       suppression:
         suppressionFile: $(Build.SourcesDirectory)\.ado\guardian\sdl\.gdnsuppress
     stages:
-    - stage: Warm
-      displayName: Warm feed cache
-      jobs:
-      - job: WarmFeed
-        displayName: Warm npm and NuGet feed cache
-        timeoutInMinutes: 60
-        steps:
-        - checkout: self
-          fetchDepth: 1
+      - stage: Warm
+        displayName: Warm feed cache
+        jobs:
+          - job: WarmFeed
+            displayName: Warm npm and NuGet feed cache
+            timeoutInMinutes: 60
+            steps:
+              - checkout: self
+                fetchDepth: 1
+
+              - task: UseNode@1
+                displayName: Use Node.js 24.x
+                inputs:
+                  version: '24.x'
 
-        - task: UseNode@1
-          displayName: Use Node.js 24.x
-          inputs:
-            version: '24.x'
+              # Authenticate npm/Yarn to the feed before install (same MI as CI).
+              - template: .ado/templates/auth-npm-feed.yml@self
 
-        # The agent image does not guarantee Yarn (build-template.yml installs it
-        # explicitly), and the warm script runs `yarn install`. Authenticate npm to
-        # the feed, then install the same pinned Yarn from it.
-        - template: .ado/templates/auth-npm-feed.yml@self
+              - script: yarn install --immutable
+                displayName: yarn install
+                retryCountOnTaskFailure: 2
 
-        - task: CmdLine@2
-          displayName: Install pinned Yarn from the feed
-          inputs:
-            script: npm install --global yarn@1.22.22 --registry https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/
+              - script: npx lage build --scope @rnw-scripts/warm-feed
+                displayName: Build warm-feed
+                retryCountOnTaskFailure: 2
 
-        # Interim identity (shared with auth-npm-feed.yml); swap to the RNW managed
-        # identity once it is provisioned. AzureCLI@2 logs in az as this identity, so
-        # the script's `az account get-access-token` authenticates to the feed.
-        - task: AzureCLI@2
-          displayName: Warm ms/react-native-public feed
-          inputs:
-            azureSubscription: Office-Hermes-Windows-Bot
-            scriptType: pscore
-            scriptLocation: inlineScript
-            inlineScript: |
-              $ErrorActionPreference = 'Stop'
-              & "$(Build.SourcesDirectory)/vnext/Scripts/Warm-RnwFeedCache.ps1"
+              # AzureCLI logs `az` in as the managed identity, so
+              # `az account get-access-token` mints the feed token the tool reads
+              # from WARM_FEED_TOKEN.
+              - task: AzureCLI@2
+                displayName: Warm ms/react-native-public feed
+                inputs:
+                  azureSubscription: Office-Hermes-Windows-Bot
+                  scriptType: pscore
+                  scriptLocation: inlineScript
+                  inlineScript: |
+                    $ErrorActionPreference = 'Stop'
+                    $env:WARM_FEED_TOKEN = az account get-access-token `
+                      --resource 499b84ac-1321-427f-aa17-267ca6975798 --query accessToken -o tsv
+                    $pkgs = '${{ parameters.packages }}'.Trim()
+                    $warmArgs = @()
+                    if ($pkgs) { foreach ($p in ($pkgs -split '\s+')) { $warmArgs += @('--packages', $p) } }
+                    npx warm-feed @warmArgs