eng, use ESRP for typespec-java release (#3324)

Author: weidongxu-microsoft

eng/pipelines/publish-typespec-java.yaml

@@ -15,6 +15,8 @@ extends:
           variables:
           - template: /eng/pipelines/variables/globals.yml
           - template: /eng/pipelines/variables/image.yml
+          - name: buildArtifactsPath
+            value: $(Pipeline.Workspace)/build_artifacts
 
           pool:
             name: $(LINUXPOOL)
@@ -67,11 +69,43 @@ extends:
             env:
               GH_TOKEN: $(azuresdk-github-pat)
 
-          - script: |
-              npm config set //registry.npmjs.org/:_authToken=$(azure-sdk-npm-token)
-              ls *.tgz | npm publish -0 --access public
-              npm config delete //registry.npmjs.org/:_authToken
+          - pwsh: |
+              New-Item -ItemType Directory -Path "$(buildArtifactsPath)/packages" -Force
+              Copy-Item -Path "./typespec-extension/*.tgz" -Destination "$(buildArtifactsPath)/packages"
+            displayName: 'Copy packages to artifacts staging directory'
+
+          # create npmrc file with auth
+          - template: /eng/pipelines/templates/steps/create-authenticated-npmrc.yml
+            parameters:
+              npmrcPath: $(buildArtifactsPath)/packages/.npmrc
+              registryUrl: https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-js/npm/registry/
+
+          # publish to devops feed
+          - pwsh: |
+              $packageFiles = Get-ChildItem -Path . -Filter '*.tgz'
+              foreach ($file in $packageFiles.Name) {
+                Write-Host "npm publish $file --verbose --access public"
+                npm publish $file --verbose --access public
+              }
+            displayName: Publish to DevOps feed
+            workingDirectory: $(buildArtifactsPath)/packages
+
+          # publish to npmjs.org
+          - task: EsrpRelease@11
             displayName: 'Publish TypeSpec Java to NPM'
-            workingDirectory: ./typespec-extension
+            inputs:
+              ConnectedServiceName: Azure SDK PME Managed Identity
+              ClientId: 5f81938c-2544-4f1f-9251-dd9de5b8a81b
+              DomainTenantId: 975f013f-7f24-47e8-a7d3-abc4752bf346
+              UseManagedIdentity: true
+              KeyVaultName: kv-azuresdk-codesign
+              SignCertName: azure-sdk-esrp-release-certificate
+              Intent: PackageDistribution
+              ContentType: npm
+              FolderLocation: $(buildArtifactsPath)/packages
+              Owners: ${{ coalesce(variables['Build.RequestedForEmail'], 'azuresdk@microsoft.com') }}
+              Approvers: ${{ coalesce(variables['Build.RequestedForEmail'], 'azuresdk@microsoft.com') }}
+              ServiceEndpointUrl: https://api.esrp.microsoft.com
+              MainPublisher: ESRPRELPACMANTEST
 
           - template: /eng/pipelines/steps/cleanup-maven-local-cache.yml

eng/pipelines/templates/steps/create-authenticated-npmrc.yml

@@ -0,0 +1,24 @@
+parameters:
+  - name: npmrcPath
+    type: string
+  - name: registryUrl
+    type: string
+
+steps:
+  - pwsh: |
+      Write-Host "Creating .npmrc file ${{ parameters.npmrcPath }} for registry ${{ parameters.registryUrl }}"
+      $parentFolder = Split-Path -Path '${{ parameters.npmrcPath }}' -Parent
+
+      if (!(Test-Path $parentFolder)) {
+        Write-Host "Creating folder $parentFolder"
+        New-Item -Path $parentFolder -ItemType Directory | Out-Null
+      }
+
+      $content = "registry=${{ parameters.registryUrl }}`n`n" + "always-auth=true"
+      $content | Out-File '${{ parameters.npmrcPath }}'
+    displayName: "Create .npmrc"
+
+  - task: npmAuthenticate@0
+    displayName: Authenticate .npmrc
+    inputs:
+      workingFile: ${{ parameters.npmrcPath }}