fix(ci): unify npm auth strategy, add always-auth, better logging

.gitea/workflows/deploy.yml

@@ -163,13 +163,23 @@ jobs:
           TOKEN="${{ secrets.NPM_TOKEN }}"
           if [ -z "$TOKEN" ]; then TOKEN="${{ secrets.MINTEL_PRIVATE_TOKEN }}"; fi
           if [ -z "$TOKEN" ]; then TOKEN="${{ secrets.GITEA_PAT }}"; fi
-          if [ -z "$TOKEN" ]; then echo "Missing NPM_TOKEN secret! Add it to Gitea repo settings."; exit 1; fi
+          if [ -z "$TOKEN" ]; then echo "❌ Missing NPM_TOKEN / MINTEL_PRIVATE_TOKEN / GITEA_PAT secret!"; exit 1; fi
-          echo "@mintel:registry=https://${{ vars.REGISTRY_HOST || 'git.infra.mintel.me/api/packages/mmintel/npm/' }}" > .npmrc
+
-          echo "//${{ vars.REGISTRY_HOST || 'git.infra.mintel.me/api/packages/mmintel/npm/' }}:_authToken=${TOKEN}" >> .npmrc
+          # Mask token in logs (just in case, but Gitea usually does this automatically)
+          echo "::add-mask::$TOKEN"
+
+          echo "Configuring .npmrc for git.infra.mintel.me..."
+          echo "@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm/" > .npmrc
+          echo "//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${TOKEN}" >> .npmrc
+          echo "always-auth=true" >> .npmrc
+
+          # Also export for pnpm to pick it up from env if needed
+          echo "NPM_TOKEN=${TOKEN}" >> $GITHUB_ENV
       - name: 🏗️ Compile Sibling Monorepo
         run: |
           cp .npmrc _at-mintel/
           cd _at-mintel
+          # Use local .npmrc or env token
           pnpm install --no-frozen-lockfile
           pnpm build
       - name: Install dependencies