[TypeSpecRequirement] Only allow one version per suppression (#29001)

- Fixes #28755

eng/scripts/TypeSpec-Requirement.ps1

@@ -20,9 +20,37 @@ function Get-Suppression {
 
   # -NoEnumerate to prevent single-element arrays from being collapsed to a single object
   # -AsHashtable is closer to raw JSON than PSCustomObject
-  $suppressions = npx get-suppressions TypeSpecRequirement $fileInSpecFolder | ConvertFrom-Json -NoEnumerate -AsHashtable
+  $suppressions = npm exec --no -- get-suppressions TypeSpecRequirement $fileInSpecFolder | ConvertFrom-Json -NoEnumerate -AsHashtable
 
-  return $suppressions ? $suppressions[0] : $null;
+  if ($LASTEXITCODE -ne 0) {
+      LogError "Failure running 'npm exec get-suppressions'"
+      LogJobFailure
+      exit 1
+  }
+
+  # For now, we just use the first matching suppression returned by "get-suppressions" (#29003)
+  $suppression = $suppressions ? $suppressions[0] : $null
+
+  if ($suppression) {
+    $path = $suppression["path"]
+
+    # Path must specify a single version (without wildcards) under "preview|stable"
+    # 
+    # Allowed:    data-plane/Azure.Contoso.WidgetManager/preview/2022-11-01-preview/**/*.json
+    # Disallowed: data-plane/Azure.Contoso.WidgetManager/preview/**/*.json
+    # Disallowed: data-plane/**/*.json
+    # 
+    # Include "." since a few specs use versions like "X.Y" instead of "YYYY-MM-DD"
+    $singleVersionPattern = "/(preview|stable)/[A-Za-z0-9._-]+/"
+
+    if ($path -notmatch $singleVersionPattern) {
+      LogError ("Invalid path '$path'.  Path must only include one version per suppression.")
+      LogJobFailure
+      exit 1
+    }
+  }
+
+  return $suppression
 }
 
 $repoPath = Resolve-Path "$PSScriptRoot/../.."