[release/13.4] Allow either required npm publish owner

[adamint]

Summary

• allow npm ESRP owner validation to accept either configured required owner instead of requiring both
• keep approver validation requiring all configured approvers
• add a pipeline regression test for the owner/approver split

Testing

• dotnet test --project tests/Infrastructure.Tests/Infrastructure.Tests.csproj --no-launch-profile -- --filter-not-trait "quarantined=true" --filter-not-trait "outerloop=true"

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 17975

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 17975"

[Copilot]

Pull request overview

Updates the release publish pipeline’s npm ESRP validation so owners only need to match any configured “required owner” alias (rather than all), while approvers continue to require all configured required approvers. Adds an infrastructure regression test to prevent the owner/approver validation semantics from converging again.

Changes:

• Add Assert-ContainsAnyRequiredNpmAlias and use it for NpmPublishOwners validation.
• Keep Assert-ContainsRequiredNpmAliases for NpmPublishApprovers validation (all required approvers must be present).
• Add a pipeline test to assert the intended owner-vs-approver validation split.

Show a summary per file

File	Description
eng/pipelines/release-publish-nuget.yml	Introduces “any required owner” validation and switches the owners check to use it.
tests/Infrastructure.Tests/Pipelines/ReleasePublishNugetPipelineTests.cs	Adds a regression test asserting owners use “any” validation while approvers remain “all”.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 1