chore: implement robust registry authentication via functional discovery

.gitea/workflows/ci.yml

@@ -25,10 +25,14 @@ jobs:
         with:
           node-version: 20
 
-      - name: Install dependencies
+      - name: 🔐 Registry Auth
-        run: pnpm install --no-frozen-lockfile
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITEA_PAT: ${{ secrets.GITEA_PAT }}
+          MINTEL_PRIVATE_TOKEN: ${{ secrets.MINTEL_PRIVATE_TOKEN }}
+        run: bash scripts/registry-auth.sh
+      - name: Install dependencies
+        run: pnpm install --no-frozen-lockfile
 
       - name: 🧪 QA Checks
         env:

.gitea/workflows/deploy.yml

@@ -170,9 +170,13 @@ jobs:
         with:
           node-version: 20
 
-      - name: Install dependencies
+      - name: 🔐 Registry Auth
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITEA_PAT: ${{ secrets.GITEA_PAT }}
+          MINTEL_PRIVATE_TOKEN: ${{ secrets.MINTEL_PRIVATE_TOKEN }}
+        run: bash scripts/registry-auth.sh
+      - name: Install dependencies
         run: |
           pnpm store prune
           pnpm install --no-frozen-lockfile
@@ -383,10 +387,14 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 20
-      - name: Install dependencies
+      - name: 🔐 Registry Auth
-        id: deps
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITEA_PAT: ${{ secrets.GITEA_PAT }}
+          MINTEL_PRIVATE_TOKEN: ${{ secrets.MINTEL_PRIVATE_TOKEN }}
+        run: bash scripts/registry-auth.sh
+      - name: Install dependencies
+        id: deps
         run: |
           pnpm store prune
           pnpm install --no-frozen-lockfile

.gitea/workflows/qa.yml

@@ -29,10 +29,14 @@ jobs:
         with:
           path: node_modules
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
-      - name: Install
+      - name: 🔐 Registry Auth
-        if: steps.cache-deps.outputs.cache-hit != 'true'
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITEA_PAT: ${{ secrets.GITEA_PAT }}
+          MINTEL_PRIVATE_TOKEN: ${{ secrets.MINTEL_PRIVATE_TOKEN }}
+        run: bash scripts/registry-auth.sh
+      - name: Install
+        if: steps.cache-deps.outputs.cache-hit != 'true'
         run: pnpm install --no-frozen-lockfile
       - name: 🌐 Install Chrome & Dependencies
         run: |

scripts/registry-auth.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+set -e
+
+# Robust Registry Authentication Script
+# Following Mintel CI/CD Hardening Standards
+
+# 1. Discovery
+TOKENS="${NPM_TOKEN} ${GITEA_PAT} ${MINTEL_PRIVATE_TOKEN}"
+# Add more potential user aliases
+USERS="${GITHUB_REPOSITORY_OWNER} ${GITHUB_ACTOR} marcmintel mintel mmintel"
+
+VALID_TOKEN=""
+VALID_USER=""
+
+echo "🔍 Starting functional registry discovery..."
+
+for T in $TOKENS; do
+    [ -z "$T" ] && continue
+    for U in $USERS; do
+        [ -z "$U" ] && continue
+        
+        T_MASKED="${T:0:4}..."
+        # Use Gitea API to verify token
+        STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token $T" "https://git.infra.mintel.me/api/v1/user" || echo "500")
+        
+        if [ "$STATUS" == "200" ]; then
+            VALID_TOKEN="$T"
+            VALID_USER="$U"
+            echo "✅ Token verified via API (User: $U)"
+            break 2
+        fi
+    done
+done
+
+# Fallback: If API verification failed, try to use NPM_TOKEN if provided
+if [ -z "$VALID_TOKEN" ] && [ -n "$NPM_TOKEN" ]; then
+    echo "⚠️ API verification failed, falling back to provided NPM_TOKEN"
+    VALID_TOKEN="$NPM_TOKEN"
+fi
+
+if [ -z "$VALID_TOKEN" ]; then
+    echo "❌ CRITICAL: No valid registry token found in environment."
+    echo "Available env vars: NPM_TOKEN=${NPM_TOKEN:0:2}..., GITEA_PAT=${GITEA_PAT:0:2}..., MINTEL_PRIVATE_TOKEN=${MINTEL_PRIVATE_TOKEN:0:2}..."
+    exit 1
+fi
+
+# 2. Hardened .npmrc Generation
+# We use the pattern from klz-2026 which is known to work
+cat << EOF > .npmrc
+@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm
+//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${VALID_TOKEN}
+//git.infra.mintel.me/api/packages/mmintel/npm/:always-auth=true
+//registry.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${VALID_TOKEN}
+//registry.infra.mintel.me/api/packages/mmintel/npm/:always-auth=true
+EOF
+
+echo "✅ .npmrc hardened and generated."