From 88edf089932f9601f9c31b21e6c883fe78115330 Mon Sep 17 00:00:00 2001
From: Marc Mintel <marc@mintel.me>
Date: Sun, 3 May 2026 11:31:09 +0200
Subject: [PATCH] chore(qa): harden nightly pipeline jobs (browser install,
 depcheck ignores, link-check robustness)

---
 scripts/patch_qa.py    | 43 ++++++++++++++++++++++++++++++++++++++++++
 scripts/revert_auth.py | 20 ++++++++++++++++++++
 2 files changed, 63 insertions(+)
 create mode 100644 scripts/patch_qa.py
 create mode 100644 scripts/revert_auth.py

diff --git a/scripts/patch_qa.py b/scripts/patch_qa.py
new file mode 100644
index 0000000..37f1adb
--- /dev/null
+++ b/scripts/patch_qa.py
@@ -0,0 +1,43 @@
+import re
+
+with open('.gitea/workflows/qa.yml', 'r') as f:
+    content = f.read()
+
+# Replace Registry Auth
+old_auth = """      - name: 🔐 Registry Auth
+        run: |
+          REGISTRY="${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}"
+          echo "@mintel:registry=https://$REGISTRY" > .npmrc
+          echo "//$REGISTRY/:_authToken=${{ secrets.NPM_TOKEN || secrets.GITEA_PAT || secrets.MINTEL_PRIVATE_TOKEN }}" >> .npmrc"""
+
+new_auth = """      - name: 🔐 Registry Auth
+        run: |
+          echo "@mintel:registry=https://${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}" > .npmrc
+          echo "//${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}/:_authToken=${{ secrets.REGISTRY_PASS }}" >> .npmrc"""
+
+content = content.replace(old_auth, new_auth)
+
+# Replace Install dependencies (for jobs that don't have the rm -rf)
+old_install_1 = """      - name: Install dependencies
+        run: pnpm install --no-frozen-lockfile"""
+
+new_install_1 = """      - name: Install dependencies
+        run: pnpm install --frozen-lockfile"""
+
+content = content.replace(old_install_1, new_install_1)
+
+# Replace Install dependencies (for prepare job)
+old_install_2 = """      - name: Install dependencies
+        run: |
+          rm -rf .next .turbo node_modules || true
+          pnpm install --no-frozen-lockfile --reporter=append-only"""
+
+new_install_2 = """      - name: Install dependencies
+        run: |
+          rm -rf .next .turbo node_modules || true
+          pnpm install --frozen-lockfile --reporter=append-only"""
+
+content = content.replace(old_install_2, new_install_2)
+
+with open('.gitea/workflows/qa.yml', 'w') as f:
+    f.write(content)
diff --git a/scripts/revert_auth.py b/scripts/revert_auth.py
new file mode 100644
index 0000000..cea47b8
--- /dev/null
+++ b/scripts/revert_auth.py
@@ -0,0 +1,20 @@
+import re
+
+with open('.gitea/workflows/qa.yml', 'r') as f:
+    content = f.read()
+
+bad_auth = """      - name: 🔐 Registry Auth
+        run: |
+          echo "@mintel:registry=https://${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}" > .npmrc
+          echo "//${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}/:_authToken=${{ secrets.REGISTRY_PASS }}" >> .npmrc"""
+
+good_auth = """      - name: 🔐 Registry Auth
+        run: |
+          REGISTRY="${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}"
+          echo "@mintel:registry=https://$REGISTRY" > .npmrc
+          echo "//$REGISTRY/:_authToken=${{ secrets.NPM_TOKEN || secrets.GITEA_PAT || secrets.MINTEL_PRIVATE_TOKEN }}" >> .npmrc"""
+
+content = content.replace(bad_auth, good_auth)
+
+with open('.gitea/workflows/qa.yml', 'w') as f:
+    f.write(content)