chore(qa): harden nightly pipeline jobs (browser install, depcheck ignores, link-check robustness)

scripts/patch_qa.py

@@ -0,0 +1,43 @@
+import re
+
+with open('.gitea/workflows/qa.yml', 'r') as f:
+    content = f.read()
+
+# Replace Registry Auth
+old_auth = """      - name: 🔐 Registry Auth
+        run: |
+          REGISTRY="${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}"
+          echo "@mintel:registry=https://$REGISTRY" > .npmrc
+          echo "//$REGISTRY/:_authToken=${{ secrets.NPM_TOKEN || secrets.GITEA_PAT || secrets.MINTEL_PRIVATE_TOKEN }}" >> .npmrc"""
+
+new_auth = """      - name: 🔐 Registry Auth
+        run: |
+          echo "@mintel:registry=https://${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}" > .npmrc
+          echo "//${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}/:_authToken=${{ secrets.REGISTRY_PASS }}" >> .npmrc"""
+
+content = content.replace(old_auth, new_auth)
+
+# Replace Install dependencies (for jobs that don't have the rm -rf)
+old_install_1 = """      - name: Install dependencies
+        run: pnpm install --no-frozen-lockfile"""
+
+new_install_1 = """      - name: Install dependencies
+        run: pnpm install --frozen-lockfile"""
+
+content = content.replace(old_install_1, new_install_1)
+
+# Replace Install dependencies (for prepare job)
+old_install_2 = """      - name: Install dependencies
+        run: |
+          rm -rf .next .turbo node_modules || true
+          pnpm install --no-frozen-lockfile --reporter=append-only"""
+
+new_install_2 = """      - name: Install dependencies
+        run: |
+          rm -rf .next .turbo node_modules || true
+          pnpm install --frozen-lockfile --reporter=append-only"""
+
+content = content.replace(old_install_2, new_install_2)
+
+with open('.gitea/workflows/qa.yml', 'w') as f:
+    f.write(content)