Ensure that our CLI lib tests use Yarn v4 (#16405)

* Ensure that our CLI lib tests use Yarn v4

* Change files

* Update the feed warmer

Author: vmoroz

.ado/README.md

@@ -39,8 +39,14 @@ branches, all driven from YAML. Keep the branch lists in `ci-pipeline.yml`,
 `0.82-stable` is deprecated and removed from all pipelines. `0.80-stable` and
 earlier are not built.
 
-Feed warm-up (`warm-feed-pipeline.yml`) is branch-agnostic (scheduled on `main`).
-Branch *creation* is governed separately by the ruleset in
+Feed warm-up (`warm-feed-pipeline.yml`, scheduled on `main`) has two passes: the
+latest-patch enumeration is branch-agnostic (feed-centric), while the closure pass
+reproduces the `create-react-native-library` CLI-init graph **per built release
+branch**. That branch list lives in
+[`warm-feed.config.json`](../packages/@rnw-scripts/warm-feed/warm-feed.config.json)
+(`closure.modules.create-react-native-library.branches`) — keep it in sync with the
+built branches above (it omits the not-yet-integrated ones). Branch *creation* is
+governed separately by the ruleset in
 [`repo-rules/`](./repo-rules/README.md).
 
 ## Template-repository wiring (per-entry `PipelineTemplates` alias)

.ado/warm-feed-pipeline.yml

@@ -2,11 +2,14 @@
 #
 # Enumerates the ms/react-native-public feed and re-pulls, with the pipeline's
 # managed identity, the latest patch of every npm/NuGet major.minor line already
-# in use, so anonymous network-isolated PR/CI builds can restore them.
+# in use, so anonymous network-isolated PR/CI builds can restore them. The
+# scheduled run also resolves and warms the configured closure modules (see
+# warm-feed.config.json), e.g. the create-react-native-library CLI-init closure
+# across every release branch, which enumeration alone can't discover.
 #
 # Runs out of band (never in a PR build) because saving into the feed needs the
 # managed identity. A maintainer can also queue it with the `packages` parameter
-# to warm a specific set of versions on demand.
+# (exact versions) or `closureModules` parameter (a graph) to warm on demand.
 
 name: $(Date:yyyyMMdd).$(Rev:r)
 
@@ -18,6 +21,10 @@ parameters:
     displayName: 'One-off warm (space-separated): npm:foo@1.2.3 nuget:Bar@4.0.0'
     type: string
     default: ' '
+  - name: closureModules
+    displayName: "One-off closure warm (space-separated module names, or 'all')"
+    type: string
+    default: ' '
 
 schedules:
   - cron: '0 0,6,12,18 * * *'
@@ -60,7 +67,9 @@ extends:
         jobs:
           - job: WarmFeed
             displayName: Warm npm and NuGet feed cache
-            timeoutInMinutes: 60
+            # Longer than a plain sync: the scheduled run also scaffolds and
+            # resolves the create-react-native-library closure per release branch.
+            timeoutInMinutes: 120
             steps:
               - checkout: self
                 fetchDepth: 1
@@ -91,6 +100,7 @@ extends:
                 # under the feed managed identity).
                 env:
                   WARM_FEED_PACKAGES: ${{ parameters.packages }}
+                  WARM_FEED_CLOSURE_MODULES: ${{ parameters.closureModules }}
                 inputs:
                   azureSubscription: Office-Hermes-Windows-Bot
                   scriptType: pscore
@@ -100,6 +110,8 @@ extends:
                     $env:WARM_FEED_TOKEN = az account get-access-token `
                       --resource 499b84ac-1321-427f-aa17-267ca6975798 --query accessToken -o tsv
                     $pkgs = "$env:WARM_FEED_PACKAGES".Trim()
+                    $mods = "$env:WARM_FEED_CLOSURE_MODULES".Trim()
                     $warmArgs = @()
                     if ($pkgs) { foreach ($p in ($pkgs -split '\s+')) { $warmArgs += @('--packages', $p) } }
+                    if ($mods) { foreach ($m in ($mods -split '\s+')) { $warmArgs += @('--closure-module', $m) } }
                     npx warm-feed @warmArgs

change/react-native-windows-bfa58cdb-5f79-4c9f-984b-3991143d645d.json

@@ -0,0 +1,7 @@
+{
+  "type": "prerelease",
+  "comment": "Ensure that our CLI lib tests use Yarn v4",
+  "packageName": "react-native-windows",
+  "email": "vmorozov@microsoft.com",
+  "dependentChangeType": "patch"
+}

packages/@rnw-scripts/warm-feed/README.md

@@ -49,6 +49,71 @@ yarn warm-feed
 npm|nuget`, `--dry-run`, `--verify` (warm even already-cached targets),
 `--concurrency <n>`, `-v` / `--verbose`. See `--help` for the full list.
 
+## Closure (graph) warming
+
+Enumeration keeps **known** package lines fresh but can't introduce a **brand-new**
+name the feed has never seen — e.g. the packages a bumped
+`create-react-native-library` pulls into a generated project. Closure warming
+closes that gap: it resolves a dependency **graph** and warms every version in it.
+
+The graph is resolved with `npm install --package-lock-only` (metadata only; the
+feed save still happens per version). The lockfile covers the **resolve host's own
+platform** (Windows x64 in CI). It can also list other-OS/CPU optional variants, but
+not dependably against an Azure Artifacts upstream proxy: npm 11+ writes
+not-yet-cached, non-current-platform optional deps without a `version`
+(npm/cli#9342) and the parser drops version-less entries. Warming every platform's
+optional deps would need a per-OS/CPU resolve.
+
+Three ways to feed it a graph:
+
+```powershell
+# 1. Roots — warm the full npm graph of one or more packages:
+yarn warm-feed --closure npm:create-react-native-library@0.63.0
+
+# 2. Manifest — warm the external-dependency graph of a package.json:
+yarn warm-feed --closure-manifest ./some/package.json
+
+# 3. Special module — a registered reproducer for a case enumeration can't see:
+yarn warm-feed --closure-module create-react-native-library
+yarn warm-feed --closure-module all      # every enabled module
+```
+
+### Special modules (pluggable)
+
+A **special module** reproduces a specific install closure and turns it into a
+dependency graph to warm. They live in `src/specialModules/` and are registered
+in `src/specialModules/index.ts`; add a module there and it's available to config
+(`closure.modules.<name>`) and `--closure-module <name>`.
+
+The first module, **`create-react-native-library`**, reproduces the CLI-init lib
+test: the test scaffolds a library (+ vanilla example app) and installs *that
+generated project*, so its closure — not cRNL's own dependencies — is what the
+feed needs. warm-feed runs only from `main`, but the test runs on every release
+branch pinned to a different React Native, so the module's config manifest lists
+all branches and, per branch, derives the RN/CLI versions (nightly for `main`
+from the working-tree `vnext/package.json`; for `0.NN-stable`, the exact
+`react-native` that branch pins in its own `vnext/package.json`, read via git),
+scaffolds, and reads the generated manifests. Mirrors
+`vnext/Scripts/creaternwlib.cmd`.
+
+The scheduled pipeline run warms every **enabled** configured module in addition
+to the latest-patch sync, so brand-new closures stay warm automatically.
+
+### NuGet lock closure
+
+The special modules above are npm-only. NuGet has the same gap — enumeration only
+refreshes lines already in the feed — for which the repo's committed
+`packages.lock.json` files are the source of truth: they pin the full resolved
+NuGet closure (incl. transitives) every project restores. warm-feed scans them and
+warms every `name@resolved` they list, so a brand-new NuGet package (or an exact
+non-latest pinned version) restores under isolation.
+
+The scheduled pass does this automatically (unless `closure.nugetLocks.enabled` is
+`false`, or `--only npm`); `--nuget-locks` runs just this pass one-off. Scanning is
+local (no feed access), so it is included in a `--dry-run` plan. By default it
+scans the repo root (`--repo-root`, default cwd), pruning `node_modules`; narrow it
+with `closure.nugetLocks.roots`.
+
 ## Pipeline usage
 
 `.ado/warm-feed-pipeline.yml` runs the tool on a schedule (and on manual queue)
@@ -76,13 +141,19 @@ maintainer queues the pipeline with the `packages` parameter
 | `expand.maxMajorsBack` | Limit to the N most-recent majors already in use (0 = no limit). |
 | `concurrency` | Parallel requests. |
 | `ignore` | `id`, `id@version`, or `eco:id@version` entries to skip. |
+| `closure.registry` | npm registry for closure resolution (defaults to `feeds.npm.registry`). |
+| `closure.modules` | Per-module config blocks (e.g. `create-react-native-library`), keyed by module name; each may set `enabled: false`. |
+| `closure.nugetLocks` | NuGet `packages.lock.json` closure: `enabled` (default true) and `roots` (repo-relative dirs to scan; default repo root). |
 
 ## Scope and limitations
 
-- Warms **latest patch per in-use line**, not a specific build's exact
-  lockfile-pinned closure. A build pinning an older patch, or a version whose
-  transitive graph differs, is not guaranteed by this pass alone.
-- Cannot introduce a **brand-new package name** the feed has never seen (that name
-  is not in the feed's list). First use is covered by the authenticated CI build
-  that restores it, or by a one-off `--packages` warm.
-- Does not resolve transitive closures (each warmed version is fetched on its own).
+- The enumeration pass warms **latest patch per in-use line**, not a specific
+  build's exact lockfile-pinned closure. A build pinning an older patch is not
+  guaranteed by that pass alone — use closure warming for exact graphs.
+- Enumeration cannot introduce a **brand-new package name** the feed has never
+  seen, nor an exact non-latest pinned version. Covered instead by closure warming:
+  for **npm** a special module, `--closure`, or `--closure-manifest`; for **NuGet**
+  the `packages.lock.json` closure (above). The authenticated CI build that first
+  restores a package, or a one-off `--packages` warm, also cover it.
+- Closure resolution needs `npm` on `PATH` (bundled with Node) and, for special
+  modules that scaffold, network access to the feed for the generator.

packages/@rnw-scripts/warm-feed/src/auth.ts

@@ -42,6 +42,9 @@ export function resolveAuth(log: Logger, pat?: string): Auth {
       async header() {
         return {Authorization: `Bearer ${bearer}`};
       },
+      async token() {
+        return bearer;
+      },
     };
   }
 
@@ -54,6 +57,9 @@ export function resolveAuth(log: Logger, pat?: string): Auth {
       async header() {
         return {Authorization: `Basic ${basic}`};
       },
+      async token() {
+        return explicit;
+      },
     };
   }
 
@@ -75,5 +81,8 @@ export function resolveAuth(log: Logger, pat?: string): Auth {
     async header() {
       return {Authorization: `Bearer ${get()}`};
     },
+    async token() {
+      return get();
+    },
   };
 }