Add .npmrc next to package.json and add lockfile for PublishAIEvaluationReport (#7108)

* Add .npmrc next to package.json

The .npmrc is not transitively looked up in parent directories like other config files, it needs to be next to the package.json

Also remove the always-auth entry since it is deprecated/unused in npm and will be removed: actions/setup-node#1305

* Don't run npm install in CI, it should only be run locally by an authenticated developer

* Update vulnerable npm packages

* Make sure we're using AzDO feed in package-lock.json

* Add UpdateNpmDependencies.ps1 script

Author: akoeplinger

.npmrc

@@ -1,2 +1 @@
 registry=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
-always-auth=true

scripts/UpdateNpmDependencies.ps1

@@ -0,0 +1,60 @@
+# This script needs to be run on PowerShell 7+ (for ConvertFrom-Json) in the directory of the project
+
+param (
+    [switch]$WhatIf
+)
+
+$ErrorActionPreference = "Stop"
+
+if (-not (Test-Path .\package.json)) {
+    Write-Error "package.json not found in the current directory. Please run this script in the directory of the project."
+    exit 1
+}
+
+try {
+    Get-Command artifacts-npm-credprovider | Out-Null
+    Write-Host "artifacts-npm-credprovider is already installed"
+}
+catch {
+    Write-Host "Installing artifacts-npm-credprovider"
+    if (-not $WhatIf) {
+        npm install -g @microsoft/artifacts-npm-credprovider --registry https://pkgs.dev.azure.com/artifacts-public/23934c1b-a3b5-4b70-9dd3-d1bef4cc72a0/_packaging/AzureArtifacts/npm/registry/
+    }
+}
+
+Write-Host "Provisioning a token for the NPM registry. You might be prompted to authenticate."
+if (-not $WhatIf) {
+    # This command provisions a token for the AzDO NPM registry to run npm install and ensure any missing package is mirrored.
+    artifacts-npm-credprovider -f -c .\.npmrc
+}
+
+Write-Host "Running npm install"
+if (-not $WhatIf) {
+    npm install --prefer-online --include optional
+}
+
+# Add optional dependencies to the cache to ensure that they get mirrored
+Write-Host "Adding optional dependencies to the cache"
+$packages = (Get-Content .\package-lock.json | ConvertFrom-Json -AsHashtable).packages
+
+$allOptionalDependencies = @()
+foreach ($packagePath in $packages.Keys) {
+    $package = $packages[$packagePath]
+    if ($null -eq $package.optionalDependencies) {
+        continue
+    }
+
+    $optionalDependencies = $package.optionalDependencies
+    foreach ($optionalDependencyName in $optionalDependencies.Keys) {
+        $optionalDependencyVersion = $optionalDependencies[$optionalDependencyName]
+        $allOptionalDependencies += "$optionalDependencyName@$optionalDependencyVersion"
+    }
+}
+
+if ($allOptionalDependencies.Count -gt 0) {
+    Write-Host "Found $($allOptionalDependencies.Count) optional dependencies:"
+    $allOptionalDependencies | ForEach-Object { Write-Host "  $_" }
+    if (-not $WhatIf) {
+        npm cache add @allOptionalDependencies
+    }
+}

src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/Directory.Build.targets

@@ -9,7 +9,7 @@
   <Target Name="NpmInstall"
           Inputs="$(_TypescriptRootPath)\package.json"
           Outputs="$(_NpmInstallStampFile)">
-    <Exec Command="npm install" WorkingDirectory="$(_TypescriptRootPath)" />
+    <Exec Command="npm ci" WorkingDirectory="$(_TypescriptRootPath)" />
     <Touch Files="$(_NpmInstallStampFile)" AlwaysCreate="true" />
   </Target>
 

src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript/.npmrc

@@ -0,0 +1 @@
+registry=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/

src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript/azure-devops-report/.gitignore

@@ -1,5 +1,4 @@
 override.json
-package-lock.json
 VSIXPackageVersion.json
 LICENSE
 

src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript/azure-devops-report/build.ps1

@@ -23,7 +23,7 @@ Write-Host "Using version $PackageVersion"
 
 # Write-Information "Building Report Publishing task"
 Set-Location $PSScriptRoot/tasks/PublishAIEvaluationReport
-npm install --omit=dev
+npm ci --omit=dev
 # Copy task files to dist folder
 New-Item -ItemType Directory -Path ./dist -Force
 copy-item -Path ./task.json -Destination ./dist/ -Force
@@ -39,7 +39,7 @@ remove-item -Path ./dist/node_modules/resolve/test -Recurse -Force -ErrorAction
 
 # Write-Information "Building Extension Package" 
 Set-Location $PSScriptRoot
-npm install
+npm ci
 npx tsc -b
 npx vite build
 

src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript/azure-devops-report/tasks/PublishAIEvaluationReport/.npmrc

@@ -0,0 +1 @@
+registry=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/