fix: broken tests ci workflow.

Author: jonathanp-okta

.gitignore

@@ -35,8 +35,9 @@ yarn-error.log*
 .vercel
 **/.vercel
 
+.npmrc
 **/.npmrc
-!/.npmrc
+.npmrc.oidc
 
 
 # Created by https://www.toptal.com/developers/gitignore/api/macos,windows,visualstudiocode,webstorm,intellij,node

.npmrc

@@ -6,6 +6,7 @@ const JF_URL = "https://a0us.jfrog.io";
 const OIDC_PROVIDER_NAME = "vercel";
 const ARTIFACTORY_NPM_HOST = "a0us.jfrog.io/artifactory/api/npm/npm";
 const PUBLIC_NPM_HOST = "registry.npmjs.org";
+const BUILD_NPMRC_PATH = ".npmrc.oidc";
 
 async function exchangeVercelOidcTokenForArtifactoryToken() {
   const oidcToken = process.env.VERCEL_OIDC_TOKEN;
@@ -50,14 +51,24 @@ function pointLockfileAtArtifactory() {
   writeFileSync("package-lock.json", rewritten);
 }
 
+// Written fresh for this build only, under --userconfig, so the Artifactory
+// registry override never leaks into a plain `npm ci` elsewhere (e.g. the
+// GitHub Actions test workflows, which install straight from the public
+// registry and have no access to this token).
+function writeBuildScopedNpmrc(npmToken) {
+  writeFileSync(
+    BUILD_NPMRC_PATH,
+    `registry=https://${ARTIFACTORY_NPM_HOST}/\n` +
+      `//${ARTIFACTORY_NPM_HOST}/:_authToken=${npmToken}\n`
+  );
+}
+
 const npmToken = await exchangeVercelOidcTokenForArtifactoryToken();
 
 // Only this ephemeral Vercel build checkout is rewritten to fetch through
 // Artifactory; the committed lockfile (used by GitHub Actions' npm ci) is
 // untouched and keeps resolving against the public registry.
 pointLockfileAtArtifactory();
+writeBuildScopedNpmrc(npmToken);
 
-execSync("npm ci", {
-  stdio: "inherit",
-  env: { ...process.env, NPM_TOKEN: npmToken },
-});
+execSync(`npm ci --userconfig ${BUILD_NPMRC_PATH}`, { stdio: "inherit" });