[0.85] Sync pipeline changes to 0.85-stable branch

[Vladimir Morozov (vmoroz)]

Description

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• Automation (CI/pipeline changes)

Why

0.85-stable was cut with an early, partial copy of the office/ISS pipeline migration and
has since missed every pipeline/tooling fix that landed on main. main and 0.81-stable
were just reconciled (PRs #16412 0.81→main, #16413 main→0.81), so main is now the
canonical unified end-state. This PR finishes the migration on 0.85-stable and applies the
post-cut fixes so main/0.81/0.85 all carry the same fixed CI/PR/Release pipeline set,
while keeping 0.85's own react-native pin and job matrix.

The main source PRs folded in here: office/ISS migration (#16350/#16359), the 7-day feed
quarantine gate (#16401), the supported-branch trigger set (#16384), the prepare-release
lockfile step (#16375), skip-already-published npm→ADO (#16406), crnl 0.63 + metro resolver
(#16405), C++23-ready Folly + third-party hygiene (#16385), and the x86 Hermes e2e fix
(#16407).

What

Finish the office/ISS pipeline migration
Bring 0.85's .ado up to main: the CI/PR/Release entry pipelines now extend the shared
build-template.yml through the per-pipeline PipelineTemplates alias (Office 1ES on ISS,
general 1ES on the public PR project), and the retired release.yml, publish.yml,
windows-vs-pr.yml, and static verdaccio/config.yaml are removed. build-template.yml,
the jobs, and the templates are reconciled to main.

Harden restore and network isolation
ISS agents run under 1ES Network Isolation. The feed registry (NPM_CONFIG_REGISTRY/
YARN_NPM_REGISTRY_SERVER), a runtime-generated Verdaccio config, the RNDT_DEV DevTools
opt-out, and the VS-installer background-update disable (agent image + a per-job belt) close
the egress attempts that green builds would otherwise hide. Restore is fixed for the
machine-signed UWP packages (NU1403, empty UWP fallback folder) and for the locked-vs-force
conflict (NU1512, decided once in the repo-root Directory.Build.props), and the
lock-regeneration script now strips stray nuget.org sources and fails loudly.

Add the 7-day feed quarantine gate
.yarnrc.yml gets an 8-day minimum-age gate (npmMinimalAgeGate: "8d") with the first-party
scopes and the upstream react-native family pre-approved, so yarn.lock can't pin a
version younger than the feed's 7-day upstream quarantine and 404 in an isolated build.

Skip already-published npm packages
The Release pipeline's npm→ADO-feed jobs drop any tarball whose version is already on the
feed, and the eligibility check invokes npm view shell-free so a caller-controlled
registry/package/version can't inject a command.

Align the supported-branch set and prepare-release
CI/PR/Release/prepare-release triggers target main + 0.81/0.83/0.84/0.85/0.86/0.87-stable
and drop retired 0.82-stable; the prepare-release bot recreates yarn.lock for the Berry
workspace.

Move the CLI library test onto create-react-native-library 0.63
creaternwlib.cmd scaffolds with create-react-native-library@0.63.0 (adds --tools, drops
the removed --local false, adds a nightly-dependency helper and hardened error handling).
The example metro.config.js gains the resolveRequest/librarySource block crnl 0.63
needs to resolve the library source (0.63 moved source into exports["."]), plus the
Windows drive-letter normalizer and an inline regex escaper.

Make the vendored Folly C++23-ready and tidy third-party sources
Folly's std::aligned_storage (removed in C++23) is replaced with folly's own
aligned_storage_t (upstream folly #2527), including the 32-bit-safe shift so x86 /WX
builds don't trip C4293. The vendored folly, fmt, and fast-float trees retain their
license, root README, and docs (with the Folly logo asset restored), the unused fmt
test//support/ trees are dropped, /external ships in the npm package, and the fork-sync
helper resolves through Node's module resolver.

Harden the x86 Hermes e2e automation channel
A null command result now serializes as a valid JSON-RPC result: null, unknown methods
return MethodNotFound, and errors are emitted under the JSON-RPC error member, so a bad
response fails one test cleanly instead of wedging the whole LegacyTextHitTestTest leg.

Bump the Hermes engine
Microsoft.JavaScript.Hermes moves to 0.0.0-2608.12001-35d34796 (matching main), with
the committed NuGet lock files regenerated to match.

Testing

Exercised through the office/ISS CI/PR matrix on this PR; each bucket is a port of an
already-merged, CI-green main/0.81 change. The npm publish-eligibility check was verified
locally with an injection probe (a malicious --registry returns false and runs no command).

Changelog

Should this change be included in the release notes: no

CI/build-infrastructure, vendored-dependency hygiene, forward-compatible C++23 Folly headers,
and an engine bump; no user-facing runtime change.

Microsoft Reviewers: Open in CodeFlow

[Copilot]

🟡 Changes recommended

The updated pipeline documentation still incorrectly describes the new explicit branch filters as *-stable wildcards.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Synchronizes 0.85-stable with the canonical CI, release, tooling, dependency, and automation fixes from main.

Changes:

• Completes the Office/ISS pipeline migration and network-isolated restore hardening.
• Updates CLI scaffolding, Hermes, NuGet restore, and JSON-RPC automation behavior.
• Adds C++23-compatible Folly storage and cleans redistributed dependencies.

File summaries

File	Description
.ado/{ci,pr,release,prepare-release-bot,build-template}.yml	Aligns pipeline topology, triggers, pools, and templates.
.ado/jobs/**	Propagates environment-aware setup across jobs.
.ado/templates/**	Adds feed authentication, compliant restore, signing, publishing, and Verdaccio behavior.
.ado/verdaccio/**	Generates an isolated-feed configuration at runtime.
.ado/image/rnw-img-vs2026-node24.json	Expands and hardens the CI image.
.ado/variables/shared.yml	Routes package restoration through the approved feed.
.ado/guardian/sdl/.gdnsuppress	Adds the Guardian suppression configuration.
.ado/{publish,windows-vs-pr}.yml	Removes obsolete pipeline entry points.
.yarnrc.yml	Adds the eight-day package age gate.
.nuget/empty-uwp-fallback/.gitkeep	Establishes the empty UWP fallback directory.
Directory.Build.props	Centralizes locked versus forced NuGet restore policy.
docs/build-pipelines.md	Updates pipeline documentation.
vnext/Scripts/**	Hardens lock regeneration and nightly dependency updates.
vnext/templates/cpp-lib/example/metro.config.js	Resolves generated libraries directly from source.
vnext/PropertySheets/**	Updates restore policy, Hermes, and CI documentation.
vnext/package.json	Includes vendored external sources in the package.
vnext/external/folly/**	Adds C++23-compatible aligned storage and retained documentation.
vnext/external/fmt/**	Retains attribution/docs while removing unused tests and support files.
vnext/external/fast-float/**	Restores upstream licenses and README retention.
packages/@rnw-scripts/fork-sync/**	Supports hoisted dependency resolution.
packages/@react-native-windows/automation-channel/**	Hardens JSON-RPC results, errors, and method dispatch.
**/packages*.lock.json	Regenerates NuGet locks for the Hermes update.
change/*.json	Adds package change records.

Review details

• Files reviewed: 150/224 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The prepare-release lockfile fix is missing, and the npm eligibility check can incorrectly skip unpublished npmjs packages.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

.ado/prepare-release-bot.yml:3

• This trigger update does not actually port the prepare-release lockfile fix promised by the PR. The checked-in prepare-release implementation still calls bumpVersions and proceeds without running yarn install --mode=update-lockfile; neither source file changed in this PR. Release PRs will therefore still contain stale workspace versions in yarn.lock and fail the immutable installs this backport is intended to fix. Please also port the updateLockfile helper and its call after the Beachball bump from #16375.

• Files reviewed: 153/227 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

The prepare-release implementation was not ported, so release PRs can still commit a stale yarn.lock and fail immutable installs.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 154/228 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

A misplaced import inside prepareRelease.ts prevents the prepare-release package from compiling.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 156/230 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

It spans 230 files across release infrastructure, feed security, native automation, engine locks, and vendored C++, while required CI remains in progress.

Review details

• Files reviewed: 156/230 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

Unmatched JSON-RPC success and error IDs can still leave requests pending indefinitely.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

packages/@react-native-windows/automation-channel/src/automationChannel.ts:163

• The same hang remains for error responses with an unknown non-null ID: this branch does nothing, leaving every actual pending request unresolved indefinitely. Handle an unmatched error ID as an unattributable protocol error (or distinguish it from a tracked stale duplicate) and reject the affected in-flight requests.

• Files reviewed: 157/231 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

The 231-file change spans release infrastructure, native dependency internals, package restoration, and production engine locks, warranting final human validation.

Review details

• Files reviewed: 157/231 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

The broad pipeline, release, native dependency, and engine changes require final human validation despite no unresolved issue found.

Review details

• Files reviewed: 156/230 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

The 232-file change spans production pipelines, publishing, restore semantics, an engine bump, and vendored C++ internals, warranting final human validation.

Review details

• Files reviewed: 158/232 changed files
• Comments generated: 0 new
• Review effort level: Balanced