fix: hardened registry authentication by using environment variables and proper .npmrc

.gitea/workflows/ci.yml

@@ -25,11 +25,6 @@ jobs:
         with:
           node-version: 20
 
-      - name: 🔐 Configure Private Registry
-        run: |
-          echo "@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm" > .npmrc
-          echo "//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> .npmrc
-
       - name: Install dependencies
         run: pnpm install --no-frozen-lockfile
         env:

.gitea/workflows/deploy.yml

@@ -170,11 +170,9 @@ jobs:
         with:
           node-version: 20
 
-      - name: 🔐 Registry Auth
-        run: |
-          echo "@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm" > .npmrc
-          echo "//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> .npmrc
       - name: Install dependencies
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           pnpm store prune
           pnpm install --no-frozen-lockfile
@@ -385,12 +383,10 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 20
-      - name: 🔐 Registry Auth
-        run: |
-          echo "@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm" > .npmrc
-          echo "//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> .npmrc
       - name: Install dependencies
         id: deps
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           pnpm store prune
           pnpm install --no-frozen-lockfile

.gitea/workflows/qa.yml

@@ -23,10 +23,6 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 20
-      - name: 🔐 Registry Auth
-        run: |
-          echo "@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm" > .npmrc
-          echo "//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> .npmrc
       - name: 📦 Cache node_modules
         uses: actions/cache@v4
         id: cache-deps
@@ -35,6 +31,8 @@ jobs:
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
       - name: Install
         if: steps.cache-deps.outputs.cache-hit != 'true'
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: pnpm install --no-frozen-lockfile
       - name: 🌐 Install Chrome & Dependencies
         run: |

.npmrc

@@ -1 +1,2 @@
 @mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm/
+//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${NPM_TOKEN}