ESRP safety net (#31292)

closes #30267

---------

Co-authored-by: Ben Broderick Phillips <ben@benbp.net>

eng/pipelines/templates/stages/archetype-js-release.yml

@@ -94,7 +94,6 @@ stages:
                               condition: succeeded()
                             - template: /eng/pipelines/templates/steps/npm-release-task.yml
                               parameters:
-                                ArtifactName: ${{parameters.ArtifactName}}
                                 Artifact: ${{artifact}}
                                 Registry: ${{parameters.Registry}}
                                 PathToArtifacts: $(Pipeline.Workspace)/${{parameters.ArtifactName}}/${{artifact.name}}
@@ -258,7 +257,6 @@ stages:
                     displayName: Detecting package archive_${{artifact.name}}
                   - template: /eng/pipelines/templates/steps/npm-release-task.yml
                     parameters:
-                      ArtifactName: ${{parameters.ArtifactName}}
                       Artifact: ${{artifact}}
                       Registry: ${{parameters.Registry}}
                       PathToArtifacts: $(Pipeline.Workspace)/${{parameters.ArtifactName}}/${{artifact.name}}

eng/pipelines/templates/stages/partner-release.yml

@@ -58,7 +58,6 @@ extends:
 
           - template: /eng/pipelines/templates/steps/npm-release-task.yml
             parameters:
-              ArtifactName: Partner Drop
               Artifact: 
                 name: Partner Drop
                 path: $(Artifacts)

eng/pipelines/templates/steps/npm-release-task.yml

@@ -1,5 +1,4 @@
 parameters:
-  ArtifactName: ''
   Artifact: {}
   Registry: ''
   PathToArtifacts: ''
@@ -10,6 +9,22 @@ steps:
   - template: /eng/common/pipelines/templates/steps/set-default-branch.yml
 
   - ${{ if eq(parameters.Registry, 'https://registry.npmjs.org/') }}:
+    - pwsh: |
+        $tarFile = (Get-ChildItem -Path "${{parameters.PathToArtifacts}}/*.tgz").FullName
+        $tempDir = "$(System.DefaultWorkingDirectory)/temp_decompress"
+        New-Item -ItemType Directory -Force -Path $tempDir
+        tar -xzf $tarFile -C $tempDir
+        $packageJsonDir = "$tempDir\package\package.json"
+        $pkg = Get-Content -Raw "$packageJsonDir" | ConvertFrom-Json
+        $packageName = $pkg.Name
+        $packageVersion = $pkg.Version
+        $packageProps = npm view $packageName -json | ConvertFrom-Json
+        $originalTags = $packageProps.'dist-tags' | ConvertTo-Json -Compress
+        echo "##vso[task.setvariable variable=PackageName]$packageName"
+        echo "##vso[task.setvariable variable=OriginalTags]$originalTags"
+        echo "##vso[task.setvariable variable=IntendedTagVersion]$packageVersion"
+      displayName: Get original tags
+
     - task: EsrpRelease@7
       inputs:
         displayName: 'Publish ${{parameters.Artifact.name}} to ESRP'
@@ -28,6 +43,14 @@ steps:
         DomainTenantId: '72f988bf-86f1-41af-91ab-2d7cd011db47'
         productstate: ${{parameters.Tag}}
 
+    - task: Powershell@2
+      displayName: Verify package tags
+      inputs:
+        targetType: filePath
+        filePath: eng/scripts/verify-npm-tags.ps1
+        arguments: -originalDistTags '$(OriginalTags)' -intendedTag ${{parameters.Tag}} -intendedTagVersion '$(IntendedTagVersion)' -packageName $(PackageName) -npmToken '$(azure-sdk-npm-token)'
+        pwsh: true
+
     - ${{ if ne(parameters.AdditionalTag, '') }}:
       - task: PowerShell@2
         displayName: Add Additional Tag

eng/scripts/verify-npm-tags.ps1

@@ -0,0 +1,47 @@
+param (
+  [Parameter(mandatory = $true)]
+  $originalDistTags,
+  [Parameter(mandatory = $true)]
+  $intendedTag,
+  [Parameter(mandatory = $true)]
+  $intendedTagVersion,
+  [Parameter(mandatory = $true)]
+  $packageName,
+  [Parameter(mandatory = $true)]
+  $npmToken
+)
+
+$ErrorActionPreference = 'Stop'
+$PSNativeCommandUseErrorActionPreference = $true
+
+Write-Host "Verify npm tag versions for package $packageName"
+
+$parsedOriginalDistTags = $originalDistTags | ConvertFrom-Json
+
+$npmPkgProp = npm view $packageName --json | ConvertFrom-Json
+$packageDistTags = $npmPkgProp."dist-tags"
+
+Write-Host "Original dist-tag: $parsedOriginalDistTags"
+Write-Host "Current dist-tag: $packageDistTags"
+Write-Host "Intend to add tag $intendedTag to version $intendedTagVersion"
+
+if ($packageDistTags."$intendedTag" -ne $intendedTagVersion) {
+  Write-Warning "Tag not correctly set, current $intendedTag tag is version $($packageDistTags."$intendedTag") instead of $intendedTagVersion."
+  $correctDistTags = $parsedOriginalDistTags
+  $correctDistTags."$intendedTag" = $intendedTagVersion
+
+  Write-Host "Setting AuthToken Deployment"
+  $regAuth = "//registry.npmjs.org/"
+  $env:NPM_TOKEN=$npmToken
+  npm config set $regAuth`:_authToken=`$`{NPM_TOKEN`}
+
+  foreach($tag in $correctDistTags.PSObject.Properties) {
+    Write-Host "npm dist-tag add $packageName@$($tag.value) $($tag.Name)"
+    npm dist-tag add $packageName@$($tag.value) $($tag.Name)
+  }
+  $npmPkgProp = npm view $packageName --json | ConvertFrom-Json
+  $packageDistTags = $npmPkgProp."dist-tags"
+  Write-Host "Corrected dist tags to: $packageDistTags"
+} else {
+  Write-Host "Tag verified."
+}