Track and address npm deprecation warnings

[mikeharder]

We should have a system to track and address npm deprecation warnings. These warnings are printed from npm install like so:

> cd sdk/template/template && npm install
npm WARN deprecated ms-rest-js@1.0.465: Package has been renamed to @azure/ms-rest-js

https://dev.azure.com/azure-sdk/public/_build/results?buildId=21897&view=logs

One option would be to simply fail the build if we detect npm WARN deprecated in the output of npm install. The upside is PRs will be rejected if they introduce dependencies on deprecated packages. The downside is a package may become deprecated at any time causing builds to suddenly fail. We already use this pattern for npm audit, so doing the same for deprecated packages seems fine.

Another option (which we could also use for npm audit), would be to set continueOnError: true on the audit and warning detection tasks. This would mark the build as "succeeded with issues" (example). The upside is the build would not fail and block PRs. The downside is it's easier to not notice builds which are "succeeding with issues", so we would need some alerting system for this, rather than relying on someone manually noticing.

[KarishmaGhiya]

This issue was created before we adopted to use rush - I think the deprecation warnings are no longer shown now - but we need to manually check on the deprecation warnings or security vulnerabilities using these steps now - #9248 cc @praveenkuttappan

[praveenkuttappan]

Security vulnerabilities reported by CG is fixed manually by weekly rotation person. @ramya-rao-a and I have discussed about adding outdated package list in report and may be we should deprecated list in that report too. But what should be our action item from automation perspective other than adding it to report? Failing scheduled builds if package deprecation warning has not been handled for x number days or weeks?

@mikeharder fyi.

[ramya-rao-a]

But what should be our action item from automation perspective other than adding it to report?

@praveenkuttappan We have chosen to log issues for each package that has a newer major version released and which we have not upgraded to. These will be tracked under the Zenhub epic #17069

For deprecated packages, we can log similar issues.

[ramya-rao-a]

@praveenkuttappan Circling back here, can we have the automation log issues for outdated and deprecated packages?

[praveenkuttappan]

@ramya-rao-a Let me have a look at this and check if we can automate it.

[ramya-rao-a]

@praveenkuttappan We now have automation logging issues for outdated packages. Does that cover the deprecated ones too?