Unified CI/PR Pipeline

[Vladimir Morozov (vmoroz)]

Description

Type of Change

• New feature (non-breaking change which adds functionality)
• Automation (AI changes or Github Actions to reduce effort of manual tasks)

Why

The existing six Azure DevOps pipelines (publish.yml, continuous.yml, compliance.yml, prepare-release-bot.yml, windows-vs-pr.yml, windows-vs-pr-secure.yml) evolved independently, causing config drift between CI and PR builds. CI built with .Publish.slnf (shipping only) while PR built with full .sln (tests only), meaning we never tested the binaries we shipped. Maintaining six pipelines with overlapping logic was error-prone.

What

Consolidated into two entry points (ci-pipeline.yml, pr-pipeline.yml) sharing a single build-template.yml. A buildEnvironment parameter (Continuous / PullRequest) controls CI-only features (ESRP signing, release tagging).

Key changes:

• Unified build+test jobs — new desktop-single.yml and universal-single.yml step templates build the full .sln, run tests, and stage shipping artifacts in one pass. We test what we ship.
• Inline Setup stage — auto-detects release vs developer builds, runs beachball bump, publishes version variables.
• SDL via 1ES template — removed manual compliance.yml and prebuild/postbuild compliance templates. CredScan, BinSkim, Component Governance, CodeQL, and ESLint configured via the sdl: block.
• CLI init simplified — downloads final signed NuGet artifact instead of re-packing from raw build outputs.
• Release tagging — CI tags source commit (react-native-windows_v<version>) on successful RELEASE builds.
• PowerShell modernization — replaced all 41 - powershell: with - pwsh: and added pwsh: true to all 13 active PowerShell@2 tasks.
• Node.js 24.x — updated all pipeline Node.js references from 22.x to 24.x.
• Cleanup — removed SecurePullRequest build environment, unused artifactName2 parameter, Attack Surface Analyzer (never produced actionable findings for a library package).

See docs/build-pipelines.md for the new pipeline architecture.

Files created

File	Purpose
.ado/ci-pipeline.yml	CI entry point
.ado/pr-pipeline.yml	PR entry point
.ado/build-template.yml	Shared build/test/pack template
.ado/jobs/desktop-single.yml	Unified Desktop build+test steps
.ado/jobs/universal-single.yml	Unified Universal build+test steps
docs/build-pipelines.md	Pipeline architecture documentation

Files deleted

File	Reason
.ado/compliance.yml	Replaced by 1ES SDL
.ado/continuous.yml	Replaced by ci-pipeline.yml
.ado/stages.yml	Logic moved to build-template.yml
.ado/windows-vs-pr-secure.yml	Replaced by pr-pipeline.yml
.ado/jobs/setup.yml	Inlined into build-template.yml
.ado/jobs/universal.yml	Replaced by universal-single.yml
.ado/jobs/desktop.yml	Replaced by desktop-single.yml
.ado/jobs/nuget-desktop.yml	Redundant with RNWNuget job
.ado/jobs/attack-surface-analyzer.yml	Not actionable for library packages
.ado/templates/run-compliance-prebuild.yml	Replaced by 1ES SDL
.ado/templates/run-compliance-postbuild.yml	Replaced by 1ES SDL
docs/attack-surface-analyzer.md	Removed with ASA

Backward-compat copies (for *-stable branches)

File	Copies
.ado/publish.yml	ci-pipeline.yml
.ado/windows-vs-pr.yml	pr-pipeline.yml

These can be deleted once all stable branches pick up build-template.yml.

Screenshots

N/A — pipeline infrastructure change, no UI changes.

Testing

• CI pipeline validated end-to-end in microsoft/ReactNative ADO project (Setup, Build, Tests, CLI stages all pass).
• PR pipeline validation pending on test PR in ms/react-native-windows.

Changelog

Should this change be included in the release notes: no

Internal pipeline infrastructure change. No user-facing behavior changes.

Microsoft Reviewers: Open in CodeFlow