[release/13.4] Improve npm publish validation and CLI package metadata

[Adam Ratzman (adamint)]

Description

Improves the release/13.4 npm publishing and package experience for the Aspire CLI.

This changes npm ESRP validation so owners must include at least one configured release owner (joperezr or ankj) instead of every configured owner, and approvers must contain exactly one Microsoft alias or email rather than the old pinned approver allowlist. It also improves the published @microsoft/aspire-cli package metadata and generated README so npm users see a clearer description, focused search keywords, Aspire positioning, install/update guidance, the Node.js requirement, and the optional dependency caveat for native platform packages.

The change also ignores local VS Code extension test/cache output folders that can be produced while validating extension scenarios.

User-facing usage

The generated npm package README now points users at the npm install flow and first Aspire commands:

npm install -g @microsoft/aspire-cli
aspire --version
aspire init
aspire run

Fixes # (issue)

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

Testing

• dotnet test --project tests/Infrastructure.Tests/Infrastructure.Tests.csproj --no-launch-profile -- --filter-class "*.ReleasePublishNugetPipelineTests" --filter-class "*.ValidateNpmReleaseAliasesTests" --filter-class "*.NpmCliPackageTests" --filter-not-trait "quarantined=true" --filter-not-trait "outerloop=true"
• dotnet test --project tests/Aspire.Cli.Tests/Aspire.Cli.Tests.csproj --no-launch-profile -- --filter-class "*.AspireJsLauncherTests" --filter-not-trait "quarantined=true" --filter-not-trait "outerloop=true"
• Smoke-packed @microsoft/aspire-cli with eng/scripts/pack-cli-npm-package.ps1 and inspected the generated README/package metadata from the .tgz.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 18093

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 18093"

[Copilot]

Pull request overview

This PR improves the npm publishing pipeline and package metadata for the Aspire CLI on the release/13.4 branch. It relaxes ESRP owner validation to require any (rather than all) configured owners while keeping all approvers required, enhances the npm package's search visibility with better metadata and a comprehensive README, fixes an exit code bug in the npm preflight check, switches to DownloadBuildArtifacts@0 for container artifacts, and adds VS Code extension test output folders to .gitignore.

Changes:

• Relaxes npm ESRP owner validation from "all required owners" to "any required owner" via a new Assert-ContainsAnyRequiredNpmAlias function, and adds exit 0 to prevent stale $LASTEXITCODE from npm view E404 responses from failing the preflight task.
• Replaces the minimal npm README with a comprehensive template (package description, code examples, install/update guidance, platform dependency caveat) and adds keywords, homepage, and an improved description to package.json.
• Switches npm validation summary downloads from the download: shortcut to explicit DownloadBuildArtifacts@0 tasks to handle 1ES container artifacts correctly, and adds extension test/cache directories to .gitignore.

Show a summary per file

File	Description
eng/pipelines/release-publish-nuget.yml	Adds SourceBuildPipeline variable, switches to DownloadBuildArtifacts@0 for container artifacts, adds Assert-ContainsAnyRequiredNpmAlias function, changes owner validation to "any" semantics, adds exit 0 to npm preflight
eng/scripts/pack-cli-npm-package.ps1	Improves package description, adds keywords/homepage, replaces minimal README with comprehensive template using __PACKAGE_NAME__ placeholders
tests/Infrastructure.Tests/Pipelines/ReleasePublishNugetPipelineTests.cs	Adds tests for exit 0 in preflight and "any owner" validation semantics
tests/Infrastructure.Tests/Pipelines/NpmCliPackageTests.cs	Adds tests for package metadata keywords/description and README template content
.gitignore	Adds VS Code extension test/cache output directories

Copilot's findings

• Files reviewed: 4/5 changed files
• Comments generated: 0

[Copilot]

Copilot's findings

• Files reviewed: 5/6 changed files
• Comments generated: 0 new

[Copilot]

Copilot's findings

• Files reviewed: 6/7 changed files
• Comments generated: 0 new

[Copilot]

Copilot's findings

• Files reviewed: 9/10 changed files
• Comments generated: 1