Bumping to latest Vally release and standardising on package.json version (#2535)

The workflows were doing their own vally installs, which means that we had the potential for drift in the version of Vally being used. Now we do a npm ci and get the version from there, removing the ambiguity

.github/workflows/external-plugin-pr-quality-gates.yml

@@ -95,8 +95,8 @@ jobs:
       - name: Install GitHub Copilot CLI
         run: npm install -g @github/copilot
 
-      - name: Install @microsoft/vally
-        run: npm install @microsoft/vally
+      - name: Install node packages
+        run: npm ci
 
       - name: Run external plugin PR quality gates
         id: quality

.github/workflows/external-plugin-quality-gates.yml

@@ -36,8 +36,8 @@ jobs:
       - name: Install GitHub Copilot CLI
         run: npm install -g @github/copilot
 
-      - name: Install @microsoft/vally
-        run: npm install @microsoft/vally
+      - name: Install node packages
+        run: npm ci
 
       - name: Run external plugin quality gates
         id: quality

package.json

@@ -39,9 +39,9 @@
   "author": "GitHub",
   "license": "MIT",
   "devDependencies": {
+    "@microsoft/vally": "^0.12.0",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
-    "@microsoft/vally": "^0.6.0",
     "all-contributors-cli": "^6.26.1"
   },
   "dependencies": {