Fix minimumReleaseAge and minimumReleaseAgeExclude for PNPM by moving…

[aaronmaxlevy]

… to pnpm-workspace.yaml

Summary

Fixes #5752

Details

This fixes support for PNPM minimumReleaseAge and minimumReleaseAgeExclude by writing them to pnpm-workspace.yaml instead. There is an existing PR open for this #5798 , however that PR moves it to .npmrc instead, whereas according to @iclanton in #5798 (comment) it is preferable to put it in pnpm-workspace.yaml instead (which I agree with). It has been two weeks since that comment was left on #5798 and it hasn't been addressed there, so I figured I'd file my own PR, given that there are real security implications to this setting not working currently. Apologies if this is undesired.

How it was tested

Ran the Rush test suite and validated outputs.

Impacted documentation

N/A

[aaronmaxlevy]

@microsoft-github-policy-service agree company="Reve AI"

[iclanton]

What happens if this is set to undefined? Is the field omitted from the output YAML in that case? If it is, we don't need this check.

Same question about minimumReleaseAgeExclude. Can that just be set to an empty array? Would that cause any issues?

[aaronmaxlevy]

Good point — I just pushed a new commit which removes these unnecessary guards, both for minimumReleaseAge and minimumReleaseAgeExclude since js-yaml will just omit it if its value is undefined.

For minimumReleaseAgeExclude, setting it to an empty array should be fine, since that is effectively what the default is with PNPM anyhow, though with the current code in this PR, that would only occur if minimumReleaseAgeExclude is explicitly set to an empty array in pnpm-config.json.