Skip to content

Commit

Permalink
[0.68] Fix Secure Supply Chain compliance issues (#12386)
Browse files Browse the repository at this point in the history
## Description

This PR backports PRs #9990, #11548 and #11855 to 0.68 to resolve Secure Supply Chain warnings.

### Type of Change
- Bug fix (non-breaking change which fixes an issue)

### Why
While 0.68-stable has no recent feature work / bug fixes, the CI and publish pipelines still run, but are failing due to these compliance requirements. These failures prevent us from monitoring if there are actual build issues with these versions.

### What
Fixed our usage of NuGet and NPM feeds to pass compliance tests.

## Screenshots
N/A

## Testing
N/A

## Changelog
Should this change be included in the release notes: no
  • Loading branch information
jonthysell committed Nov 17, 2023
1 parent 8e6e61f commit d72c496
Show file tree
Hide file tree
Showing 17 changed files with 33 additions and 77 deletions.
6 changes: 6 additions & 0 deletions .gitignore
Expand Up @@ -33,6 +33,12 @@ node_modules
# Optional REPL history
.node_repl_history

# No NPM config to pass CFS compliance
.npmrc

# We use yarn, not npm
package-lock.json

#React Native
*AppPackages*
*BundleArtifacts*
Expand Down
3 changes: 3 additions & 0 deletions GuardianCustomConfiguration.json
@@ -0,0 +1,3 @@
{
"Enabled": false,
}
6 changes: 2 additions & 4 deletions NuGet.Config
Expand Up @@ -6,9 +6,7 @@
</packageRestore>
<packageSources>
<clear />
<add key="Nuget.org" value="https://api.nuget.org/v3/index.json" />
<!-- Warning: Do not add/change the NuGet feeds here. To be compliant this repo must only rely on this single ADO feed. -->
<add key="react-native" value="https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/nuget/v3/index.json" />
</packageSources>
<disabledPackageSources>
<clear />
</disabledPackageSources>
</configuration>
@@ -0,0 +1,7 @@
{
"type": "patch",
"comment": "[0.68] Compliance: Rename template Nuget.config files to stop triggering multi-feed warnings",
"packageName": "@react-native-windows/cli",
"email": "jthysell@microsoft.com",
"dependentChangeType": "patch"
}
@@ -0,0 +1,7 @@
{
"type": "patch",
"comment": "[0.68] Fix Secure Supply Chain compliance issues",
"packageName": "react-native-windows",
"email": "jthysell@microsoft.com",
"dependentChangeType": "patch"
}
@@ -0,0 +1,7 @@
{
"type": "patch",
"comment": "[0.68] Compliance: Rename template Nuget.config files to stop triggering multi-feed warnings",
"packageName": "react-native-windows",
"email": "jthysell@microsoft.com",
"dependentChangeType": "patch"
}
Expand Up @@ -343,7 +343,7 @@ export async function copyProjectTemplateAndReplace(
const sharedProjMappings = [];

sharedProjMappings.push({
from: path.join(sharedPath, projDir, 'NuGet.Config'),
from: path.join(sharedPath, projDir, 'NuGet_Config'),
to: path.join(windowsDir, 'NuGet.Config'),
});

Expand Down
1 change: 0 additions & 1 deletion packages/e2e-test-app/.npmrc

This file was deleted.

14 changes: 0 additions & 14 deletions packages/e2e-test-app/windows/NuGet.Config

This file was deleted.

14 changes: 0 additions & 14 deletions packages/integration-test-app/windows/NuGet.Config

This file was deleted.

13 changes: 0 additions & 13 deletions packages/playground/windows/NuGet.Config

This file was deleted.

1 change: 0 additions & 1 deletion packages/sample-apps/.npmrc

This file was deleted.

14 changes: 0 additions & 14 deletions packages/sample-apps/windows/NuGet.Config

This file was deleted.

1 change: 0 additions & 1 deletion vnext/.npmrc

This file was deleted.

14 changes: 0 additions & 14 deletions vnext/NuGet.Config

This file was deleted.

File renamed without changes.
File renamed without changes.

0 comments on commit d72c496

Please sign in to comment.