Fix NuGet lock files and enforce them not changing accidentally (#14611)

## Description

This PR fixes NuGet lock files so they're more correct/compliant, and makes it easier to keep them that way.

### Type of Change
- Bug fix (non-breaking change which fixes an issue)

### Why
We recently updated to WinAppSDK 1.7 and have made other changes to the flavors we build (with different dependencies) so our lock files were out of date / constantly overriding one another.

### What

This PR fixes NuGet lock files so they're more correct/compliant. This includes:

1. Updating the `NuGetRestoreForceEvaluateAllSolutions.ps1` script to completely fix the lock files
2. Ensuring every project has a proper `packages.lock.json` file for its default configuration
3. Ensuring projects that are built old AND new arch also have a separate `newarch` lock file
4. Ensuring projects that are build with/without experimental WinUI3 also have a separate `experimentalwinui3` lock file
5. Causing an (optional) CI build error if the lock files change during the build (they shouldn't) with message to re-run the script
6. Removed all unnecessary `packages.config` files which confuse NuGet restoration

## Screenshots
N/A

## Testing
Verified no complaints about changed lock files after builds in the pipeline.

## Changelog
Should this change be included in the release notes: _no_

Author: jonthysell

.ado/jobs/e2e-test.yml

@@ -84,6 +84,7 @@ jobs:
                 buildPlatform: ${{ matrix.BuildPlatform }}
                 buildLogDirectory: $(BuildLogDirectory)
                 workingDirectory: packages/e2e-test-app
+                errorOnNuGetLockChanges: false # Sometimes the content hashes of NuGet packages are wrong on VMs, workaround for later .NET versions don't work for UWP C#.
 
             - script: |
                 echo ##vso[task.setvariable variable=StartedTests]true

.ado/jobs/integration-test.yml

@@ -94,9 +94,15 @@ jobs:
             - ${{ if eq(matrix.BuildConfiguration, 'Debug') }}:
               # The build is more likely to crash after we've started other bits that
               # take up memory. Do the expensive parts of the build first.
-              - script: yarn windows --no-launch --no-packager --no-deploy --no-autolink --arch ${{ matrix.BuildPlatform }} --logging --buildLogDirectory $(BuildLogDirectory)
-                displayName: yarn windows --no-launch
-                workingDirectory: packages/integration-test-app
+              - template: ../templates/run-windows-with-certificates.yml
+                parameters:
+                  buildEnvironment: ${{ parameters.BuildEnvironment }}
+                  buildConfiguration: ${{ matrix.BuildConfiguration }}
+                  buildPlatform: ${{ matrix.BuildPlatform }}
+                  buildLogDirectory: $(BuildLogDirectory)
+                  workingDirectory: packages/integration-test-app
+                  moreMSBuildProps: --no-packager --no-deploy --no-autolink
+                  errorOnNuGetLockChanges: false # Sometimes the content hashes of NuGet packages are wrong on VMs, workaround for later .NET versions don't work for UWP C#.
 
               - powershell: Start-Process npm.cmd -ArgumentList "run","start"
                 displayName: Start packager
@@ -132,8 +138,18 @@ jobs:
                 workingDirectory: packages/integration-test-app
 
             - ${{ if eq(matrix.BuildConfiguration, 'Release') }}:
-              - script: yarn windows --release ${{ matrix.DeployOptions }} --no-packager --no-autolink --arch ${{ matrix.BuildPlatform }} --logging --buildLogDirectory $(BuildLogDirectory)
-                displayName: yarn windows --release
+              - template: ../templates/run-windows-with-certificates.yml
+                parameters:
+                  buildEnvironment: ${{ parameters.BuildEnvironment }}
+                  buildConfiguration: ${{ matrix.BuildConfiguration }}
+                  buildPlatform: ${{ matrix.BuildPlatform }}
+                  buildLogDirectory: $(BuildLogDirectory)
+                  workingDirectory: packages/integration-test-app
+                  moreMSBuildProps: ${{ matrix.DeployOptions }} --no-packager --no-autolink
+                  errorOnNuGetLockChanges: false # Sometimes the content hashes of NuGet packages are wrong on VMs, workaround for later .NET versions don't work for UWP C#.
+
+              - script: yarn windows --release --no-build ${{ matrix.DeployOptions }} --no-packager --no-autolink --arch ${{ matrix.BuildPlatform }} --logging
+                displayName: yarn windows --release --no-build
                 workingDirectory: packages/integration-test-app
 
             - ${{ if ne(matrix.DeployOptions, '--no-deploy') }}:

.ado/jobs/playground.yml

@@ -130,16 +130,6 @@ jobs:
                 parameters:
                   workingDir: packages\playground\windows
 
-            # NuGet ignores packages.config if it detects <PackageReference>.
-            # Use restore packages.config directly to keep compabitility with ReactNativePicker.
-            - pwsh: |
-                Get-ChildItem -Recurse -Path packages.config |`
-                  Foreach-Object {`
-                    NuGet.exe Restore -PackagesDirectory packages $_`
-                  }
-              workingDirectory: packages/playground/windows
-              displayName: Restore packages.config items
-
             - template: ../templates/msbuild-sln.yml
               parameters:
                 solutionDir: packages/playground/windows

.ado/jobs/sample-apps.yml

@@ -83,6 +83,7 @@ jobs:
                 deployOption:  ${{ matrix.DeployOption }}
                 buildLogDirectory: ${{ variables['BuildLogDirectory'] }}
                 workingDirectory: packages/sample-apps
+                errorOnNuGetLockChanges: false # Sometimes the content hashes of NuGet packages are wrong on VMs, workaround for later .NET versions don't work for UWP C#.
 
             - script: yarn bundle-cpp --verbose
               displayName: Create SampleApp bundle

.ado/templates/detect-nuget-lockfile-changes.yml

@@ -0,0 +1,22 @@
+parameters:
+  - name: errorOnNuGetLockChanges
+    type: boolean
+    default: true
+
+steps:
+  - powershell: |
+        & git add */packages*.lock.json
+        $changed = git status --porcelain=v1 */packages*.lock.json
+        if ($changed -ne $null) {
+          Write-Host "Detected NuGet lock file changes during the build:"
+          Write-Host Files changed:`n([string]::Join("`n", $changed))
+          $diff = git diff --cached -- */packages*.lock.json
+          Write-Host Diff:`n([string]::Join("`n", $diff))
+          $msg = "Detected NuGet lock file changes during the build. Run vnext/Scripts/NuGetRestoreForceEvaluateAllSolutions.ps1 locally in a VS Dev PowerShell to update lock files, then submit the changes."
+          if ("${{ parameters.errorOnNuGetLockChanges }}" -eq "True") {
+            Write-Host "##vso[task.logissue type=error]Detected NuGet lock file changes during the build. Run vnext/Scripts/NuGetRestoreForceEvaluateAllSolutions.ps1 locally in a VS Dev PowerShell to update lock files, then submit the changes."
+            [Environment]::Exit(-1)
+          }
+        }
+    displayName: Detect NuGet lock file changes during build
+    condition: succeededOrFailed()

.ado/templates/msbuild-sln.yml

@@ -55,18 +55,7 @@ steps:
         $(MsBuildWarnAsErrorArgument)
         ${{parameters.msbuildArguments}}
 
-  - powershell: |
-      & git add */packages*.lock.json
-      $changed = git status --porcelain=v1 */packages*.lock.json
-      if ($changed -ne $null) {
-        Write-Host "##[warning] Detected packages.lock.json changes. See full log for details."
-        Write-Host Files changed:`n([string]::Join("`n", $changed))
-        $diff = git diff --cached -- */packages*.lock.json
-        Write-Host Diff:`n([string]::Join("`n", $diff))
-        Write-Host "Run vnext/Scripts/NuGetRestoreForceEvaluateAllSolutions.ps1 to update lock files locally."
-      }
-    displayName: Detect packages.lock.json changes during build
-    condition: succeededOrFailed()
+  - template: detect-nuget-lockfile-changes.yml
 
   - template: upload-build-logs.yml
     parameters:

.ado/templates/run-windows-with-certificates.yml

@@ -26,6 +26,9 @@ parameters:
   - name: restoreForceEvaluate
     type: boolean
     default: true
+  - name: errorOnNuGetLockChanges
+    type: boolean
+    default : true
   - name: moreMSBuildProps
     type: string
     default: ''
@@ -77,3 +80,8 @@ steps:
       workingDirectory: ${{ parameters.workingDirectory }}
 
     - template: ../templates/cleanup-certificate.yml
+
+  - ${{ if eq(parameters.restoreLockedMode, 'true') }}:
+    - template: detect-nuget-lockfile-changes.yml
+      parameters:
+        errorOnNuGetLockChanges: ${{ parameters.errorOnNuGetLockChanges }}

Directory.Build.props

@@ -28,6 +28,7 @@
   <PropertyGroup Label="NuGet">
     <MSBuildProjectExtensionsPath Condition="'$(ProjectName)' != ''">$(RootIntDir)\ProjectExtensions\$(ProjectName)\</MSBuildProjectExtensionsPath>
     <MSBuildProjectExtensionsPath Condition="'$(ProjectName)' == ''">$(RootIntDir)\ProjectExtensions\$(MSBuildProjectName)\</MSBuildProjectExtensionsPath>
+    <DisableImplicitNuGetFallbackFolder>true</DisableImplicitNuGetFallbackFolder>
   </PropertyGroup>
 
   <!-- User overrides -->

change/@react-native-windows-automation-channel-d062b7b6-bb69-4798-8a3a-7ea4f57c74e0.json

@@ -0,0 +1,7 @@
+{
+  "type": "patch",
+  "comment": "Fix NuGet lock files and enforce them not changing accidentally",
+  "packageName": "@react-native-windows/automation-channel",
+  "email": "[email protected]",
+  "dependentChangeType": "patch"
+}

change/react-native-windows-f6732fd2-654b-4af9-98ea-098abcc4889c.json

@@ -0,0 +1,7 @@
+{
+  "type": "prerelease",
+  "comment": "Fix NuGet lock files and enforce them not changing accidentally",
+  "packageName": "react-native-windows",
+  "email": "[email protected]",
+  "dependentChangeType": "patch"
+}