Fix NuGet lock files and enforce them not changing accidentally

.ado/jobs/e2e-test.yml

@@ -84,6 +84,7 @@ jobs:
                 buildPlatform: ${{ matrix.BuildPlatform }}
                 buildLogDirectory: $(BuildLogDirectory)
                 workingDirectory: packages/e2e-test-app
+                errorOnNuGetLockChanges: false # Sometimes the content hashes of NuGet packages are wrong on VMs, workaround for later .NET versions don't work for UWP C#.
 
             - script: |
                 echo ##vso[task.setvariable variable=StartedTests]true

.ado/jobs/integration-test.yml

@@ -94,9 +94,15 @@ jobs:
             - ${{ if eq(matrix.BuildConfiguration, 'Debug') }}:
               # The build is more likely to crash after we've started other bits that
               # take up memory. Do the expensive parts of the build first.
-              - script: yarn windows --no-launch --no-packager --no-deploy --no-autolink --arch ${{ matrix.BuildPlatform }} --logging --buildLogDirectory $(BuildLogDirectory)
-                displayName: yarn windows --no-launch
-                workingDirectory: packages/integration-test-app
+              - template: ../templates/run-windows-with-certificates.yml
+                parameters:
+                  buildEnvironment: ${{ parameters.BuildEnvironment }}
+                  buildConfiguration: ${{ matrix.BuildConfiguration }}
+                  buildPlatform: ${{ matrix.BuildPlatform }}
+                  buildLogDirectory: $(BuildLogDirectory)
+                  workingDirectory: packages/integration-test-app
+                  moreMSBuildProps: --no-packager --no-deploy --no-autolink
+                  errorOnNuGetLockChanges: false # Sometimes the content hashes of NuGet packages are wrong on VMs, workaround for later .NET versions don't work for UWP C#.
 
               - powershell: Start-Process npm.cmd -ArgumentList "run","start"
                 displayName: Start packager
@@ -132,8 +138,18 @@ jobs:
                 workingDirectory: packages/integration-test-app
 
             - ${{ if eq(matrix.BuildConfiguration, 'Release') }}:
-              - script: yarn windows --release ${{ matrix.DeployOptions }} --no-packager --no-autolink --arch ${{ matrix.BuildPlatform }} --logging --buildLogDirectory $(BuildLogDirectory)
-                displayName: yarn windows --release
+              - template: ../templates/run-windows-with-certificates.yml
+                parameters:
+                  buildEnvironment: ${{ parameters.BuildEnvironment }}
+                  buildConfiguration: ${{ matrix.BuildConfiguration }}
+                  buildPlatform: ${{ matrix.BuildPlatform }}
+                  buildLogDirectory: $(BuildLogDirectory)
+                  workingDirectory: packages/integration-test-app
+                  moreMSBuildProps: ${{ matrix.DeployOptions }} --no-packager --no-autolink
+                  errorOnNuGetLockChanges: false # Sometimes the content hashes of NuGet packages are wrong on VMs, workaround for later .NET versions don't work for UWP C#.
+
+              - script: yarn windows --release --no-build ${{ matrix.DeployOptions }} --no-packager --no-autolink --arch ${{ matrix.BuildPlatform }} --logging
+                displayName: yarn windows --release --no-build
                 workingDirectory: packages/integration-test-app
 
             - ${{ if ne(matrix.DeployOptions, '--no-deploy') }}:

.ado/jobs/playground.yml

@@ -130,16 +130,6 @@ jobs:
                 parameters:
                   workingDir: packages\playground\windows
 
-            # NuGet ignores packages.config if it detects <PackageReference>.
-            # Use restore packages.config directly to keep compabitility with ReactNativePicker.
-            - pwsh: |
-                Get-ChildItem -Recurse -Path packages.config |`
-                  Foreach-Object {`
-                    NuGet.exe Restore -PackagesDirectory packages $_`
-                  }
-              workingDirectory: packages/playground/windows
-              displayName: Restore packages.config items
-
             - template: ../templates/msbuild-sln.yml
               parameters:
                 solutionDir: packages/playground/windows

.ado/jobs/sample-apps.yml

@@ -83,6 +83,7 @@ jobs:
                 deployOption:  ${{ matrix.DeployOption }}
                 buildLogDirectory: ${{ variables['BuildLogDirectory'] }}
                 workingDirectory: packages/sample-apps
+                errorOnNuGetLockChanges: false # Sometimes the content hashes of NuGet packages are wrong on VMs, workaround for later .NET versions don't work for UWP C#.
 
             - script: yarn bundle-cpp --verbose
               displayName: Create SampleApp bundle

.ado/templates/detect-nuget-lockfile-changes.yml

@@ -0,0 +1,22 @@
+parameters:
+  - name: errorOnNuGetLockChanges
+    type: boolean
+    default: true
+
+steps:
+  - powershell: |
+        & git add */packages*.lock.json
+        $changed = git status --porcelain=v1 */packages*.lock.json
+        if ($changed -ne $null) {
+          Write-Host "Detected NuGet lock file changes during the build:"
+          Write-Host Files changed:`n([string]::Join("`n", $changed))
+          $diff = git diff --cached -- */packages*.lock.json
+          Write-Host Diff:`n([string]::Join("`n", $diff))
+          $msg = "Detected NuGet lock file changes during the build. Run vnext/Scripts/NuGetRestoreForceEvaluateAllSolutions.ps1 locally in a VS Dev PowerShell to update lock files, then submit the changes."
+          if ("${{ parameters.errorOnNuGetLockChanges }}" -eq "True") {
+            Write-Host "##vso[task.logissue type=error]Detected NuGet lock file changes during the build. Run vnext/Scripts/NuGetRestoreForceEvaluateAllSolutions.ps1 locally in a VS Dev PowerShell to update lock files, then submit the changes."
+            [Environment]::Exit(-1)
+          }
+        }
+    displayName: Detect NuGet lock file changes during build
+    condition: succeededOrFailed()

.ado/templates/msbuild-sln.yml

@@ -55,18 +55,7 @@ steps:
         $(MsBuildWarnAsErrorArgument)
         ${{parameters.msbuildArguments}}
 
-  - powershell: |
-      & git add */packages*.lock.json
-      $changed = git status --porcelain=v1 */packages*.lock.json
-      if ($changed -ne $null) {
-        Write-Host "##[warning] Detected packages.lock.json changes. See full log for details."
-        Write-Host Files changed:`n([string]::Join("`n", $changed))
-        $diff = git diff --cached -- */packages*.lock.json
-        Write-Host Diff:`n([string]::Join("`n", $diff))
-        Write-Host "Run vnext/Scripts/NuGetRestoreForceEvaluateAllSolutions.ps1 to update lock files locally."
-      }
-    displayName: Detect packages.lock.json changes during build
-    condition: succeededOrFailed()
+  - template: detect-nuget-lockfile-changes.yml
 
   - template: upload-build-logs.yml
     parameters:

.ado/templates/run-windows-with-certificates.yml

@@ -26,6 +26,9 @@ parameters:
   - name: restoreForceEvaluate
     type: boolean
     default: true
+  - name: errorOnNuGetLockChanges
+    type: boolean
+    default : true
   - name: moreMSBuildProps
     type: string
     default: ''
@@ -77,3 +80,8 @@ steps:
       workingDirectory: ${{ parameters.workingDirectory }}
 
     - template: ../templates/cleanup-certificate.yml
+
+  - ${{ if eq(parameters.restoreLockedMode, 'true') }}:
+    - template: detect-nuget-lockfile-changes.yml
+      parameters:
+        errorOnNuGetLockChanges: ${{ parameters.errorOnNuGetLockChanges }}

Directory.Build.props

@@ -28,6 +28,7 @@
   <PropertyGroup Label="NuGet">
     <MSBuildProjectExtensionsPath Condition="'$(ProjectName)' != ''">$(RootIntDir)\ProjectExtensions\$(ProjectName)\</MSBuildProjectExtensionsPath>
     <MSBuildProjectExtensionsPath Condition="'$(ProjectName)' == ''">$(RootIntDir)\ProjectExtensions\$(MSBuildProjectName)\</MSBuildProjectExtensionsPath>
+    <DisableImplicitNuGetFallbackFolder>true</DisableImplicitNuGetFallbackFolder>
   </PropertyGroup>
 
   <!-- User overrides -->

change/@react-native-windows-automation-channel-d062b7b6-bb69-4798-8a3a-7ea4f57c74e0.json

@@ -0,0 +1,7 @@
+{
+  "type": "patch",
+  "comment": "Fix NuGet lock files and enforce them not changing accidentally",
+  "packageName": "@react-native-windows/automation-channel",
+  "email": "jthysell@microsoft.com",
+  "dependentChangeType": "patch"
+}

change/react-native-windows-f6732fd2-654b-4af9-98ea-098abcc4889c.json

@@ -0,0 +1,7 @@
+{
+  "type": "prerelease",
+  "comment": "Fix NuGet lock files and enforce them not changing accidentally",
+  "packageName": "react-native-windows",
+  "email": "jthysell@microsoft.com",
+  "dependentChangeType": "patch"
+}

packages/@react-native-windows/automation-channel/package.json

@@ -39,10 +39,9 @@
   "files": [
     "lib-commonjs",
     "windows",
-    "!packages.lock.json",
-    "!packages.fabric.lock.json"
+    "!packages*.lock.json"
   ],
   "engines": {
     "node": ">= 18"
   }
-}
+}

packages/@react-native-windows/automation-channel/windows/AutomationChannel/packages.chakra.lock.json

@@ -0,0 +1,140 @@
+{
+  "version": 1,
+  "dependencies": {
+    "native,Version=v0.0": {
+      "Microsoft.UI.Xaml": {
+        "type": "Direct",
+        "requested": "[2.8.0, )",
+        "resolved": "2.8.0",
+        "contentHash": "vxdHxTr63s5KVtNddMFpgvjBjUH50z7seq/5jLWmmSuf8poxg+sXrywkofUdE8ZstbpO9y3FL/IXXUcPYbeesA==",
+        "dependencies": {
+          "Microsoft.Web.WebView2": "1.0.1264.42"
+        }
+      },
+      "Microsoft.Windows.CppWinRT": {
+        "type": "Direct",
+        "requested": "[2.0.230706.1, )",
+        "resolved": "2.0.230706.1",
+        "contentHash": "l0D7oCw/5X+xIKHqZTi62TtV+1qeSz7KVluNFdrJ9hXsst4ghvqQ/Yhura7JqRdZWBXAuDS0G0KwALptdoxweQ=="
+      },
+      "boost": {
+        "type": "Transitive",
+        "resolved": "1.83.0",
+        "contentHash": "cy53VNMzysEMvhBixDe8ujPk67Fcj3v6FPHQnH91NYJNLHpc6jxa2xq9ruCaaJjE4M3YrGSHDi4uUSTGBWw6EQ=="
+      },
+      "Microsoft.Build.Tasks.Git": {
+        "type": "Transitive",
+        "resolved": "1.1.1",
+        "contentHash": "AT3HlgTjsqHnWpBHSNeR0KxbLZD7bztlZVj7I8vgeYG9SYqbeFGh0TM/KVtC6fg53nrWHl3VfZFvb5BiQFcY6Q=="
+      },
+      "Microsoft.JavaScript.Hermes": {
+        "type": "Transitive",
+        "resolved": "0.1.23",
+        "contentHash": "cA9t1GjY4Yo0JD1AfA//e1lOwk48hLANfuX6GXrikmEBNZVr2TIX5ONJt5tqCnpZyLz6xGiPDgTfFNKbSfb21g=="
+      },
+      "Microsoft.SourceLink.Common": {
+        "type": "Transitive",
+        "resolved": "1.1.1",
+        "contentHash": "WMcGpWKrmJmzrNeuaEb23bEMnbtR/vLmvZtkAP5qWu7vQsY59GqfRJd65sFpBszbd2k/bQ8cs8eWawQKAabkVg=="
+      },
+      "Microsoft.SourceLink.GitHub": {
+        "type": "Transitive",
+        "resolved": "1.1.1",
+        "contentHash": "IaJGnOv/M7UQjRJks7B6p7pbPnOwisYGOIzqCz5ilGFTApZ3ktOR+6zJ12ZRPInulBmdAf1SrGdDG2MU8g6XTw==",
+        "dependencies": {
+          "Microsoft.Build.Tasks.Git": "1.1.1",
+          "Microsoft.SourceLink.Common": "1.1.1"
+        }
+      },
+      "Microsoft.Web.WebView2": {
+        "type": "Transitive",
+        "resolved": "1.0.1264.42",
+        "contentHash": "7OBUTkzQ5VI/3gb0ufi5U4zjuCowAJwQg2li0zXXzqkM+S1kmOlivTy1R4jAW+gY5Vyg510M+qMAESCQUjrfgA=="
+      },
+      "common": {
+        "type": "Project",
+        "dependencies": {
+          "boost": "[1.83.0, )"
+        }
+      },
+      "fmt": {
+        "type": "Project"
+      },
+      "folly": {
+        "type": "Project",
+        "dependencies": {
+          "boost": "[1.83.0, )",
+          "fmt": "[1.0.0, )"
+        }
+      },
+      "microsoft.reactnative": {
+        "type": "Project",
+        "dependencies": {
+          "Common": "[1.0.0, )",
+          "Folly": "[1.0.0, )",
+          "Microsoft.JavaScript.Hermes": "[0.1.23, )",
+          "Microsoft.SourceLink.GitHub": "[1.1.1, )",
+          "Microsoft.UI.Xaml": "[2.8.0, )",
+          "ReactCommon": "[1.0.0, )",
+          "boost": "[1.83.0, )"
+        }
+      },
+      "reactcommon": {
+        "type": "Project",
+        "dependencies": {
+          "Folly": "[1.0.0, )",
+          "boost": "[1.83.0, )"
+        }
+      }
+    },
+    "native,Version=v0.0/win10-arm": {
+      "Microsoft.Web.WebView2": {
+        "type": "Transitive",
+        "resolved": "1.0.1264.42",
+        "contentHash": "7OBUTkzQ5VI/3gb0ufi5U4zjuCowAJwQg2li0zXXzqkM+S1kmOlivTy1R4jAW+gY5Vyg510M+qMAESCQUjrfgA=="
+      }
+    },
+    "native,Version=v0.0/win10-arm-aot": {
+      "Microsoft.Web.WebView2": {
+        "type": "Transitive",
+        "resolved": "1.0.1264.42",
+        "contentHash": "7OBUTkzQ5VI/3gb0ufi5U4zjuCowAJwQg2li0zXXzqkM+S1kmOlivTy1R4jAW+gY5Vyg510M+qMAESCQUjrfgA=="
+      }
+    },
+    "native,Version=v0.0/win10-arm64-aot": {
+      "Microsoft.Web.WebView2": {
+        "type": "Transitive",
+        "resolved": "1.0.1264.42",
+        "contentHash": "7OBUTkzQ5VI/3gb0ufi5U4zjuCowAJwQg2li0zXXzqkM+S1kmOlivTy1R4jAW+gY5Vyg510M+qMAESCQUjrfgA=="
+      }
+    },
+    "native,Version=v0.0/win10-x64": {
+      "Microsoft.Web.WebView2": {
+        "type": "Transitive",
+        "resolved": "1.0.1264.42",
+        "contentHash": "7OBUTkzQ5VI/3gb0ufi5U4zjuCowAJwQg2li0zXXzqkM+S1kmOlivTy1R4jAW+gY5Vyg510M+qMAESCQUjrfgA=="
+      }
+    },
+    "native,Version=v0.0/win10-x64-aot": {
+      "Microsoft.Web.WebView2": {
+        "type": "Transitive",
+        "resolved": "1.0.1264.42",
+        "contentHash": "7OBUTkzQ5VI/3gb0ufi5U4zjuCowAJwQg2li0zXXzqkM+S1kmOlivTy1R4jAW+gY5Vyg510M+qMAESCQUjrfgA=="
+      }
+    },
+    "native,Version=v0.0/win10-x86": {
+      "Microsoft.Web.WebView2": {
+        "type": "Transitive",
+        "resolved": "1.0.1264.42",
+        "contentHash": "7OBUTkzQ5VI/3gb0ufi5U4zjuCowAJwQg2li0zXXzqkM+S1kmOlivTy1R4jAW+gY5Vyg510M+qMAESCQUjrfgA=="
+      }
+    },
+    "native,Version=v0.0/win10-x86-aot": {
+      "Microsoft.Web.WebView2": {
+        "type": "Transitive",
+        "resolved": "1.0.1264.42",
+        "contentHash": "7OBUTkzQ5VI/3gb0ufi5U4zjuCowAJwQg2li0zXXzqkM+S1kmOlivTy1R4jAW+gY5Vyg510M+qMAESCQUjrfgA=="
+      }
+    }
+  }
+}