ci: [@dependabot] fix npm package-ecosystem x yarn integration

- https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#npm-registry

Signed-off-by: Lexus Drumgold <[email protected]>

.github/dependabot.yml

@@ -6,6 +6,12 @@
 
 ---
 version: 2
+registries:
+  github:
+    replaces-base: true
+    token: ${{ secrets.PAT_BOT }}
+    type: npm-registry
+    url: https://npm.pkg.github.com/flex-development
 updates:
   - package-ecosystem: github-actions
     commit-message:
@@ -31,6 +37,8 @@ updates:
     labels:
       - scope:dependencies
       - type:build
+    registries:
+      - github
     reviewers:
       - flex-development/dependabot-review
       - flexdevelopment

.github/workflows/publish.yml

@@ -55,6 +55,7 @@ jobs:
   gpr:
     needs: metadata
     permissions:
+      contents: write
       packages: write
     runs-on: ubuntu-latest
     environment:
@@ -68,6 +69,9 @@ jobs:
         uses: actions/[email protected]
         with:
           ref: ${{ format('refs/tags/{0}', env.TAG) }}
+      - id: npmrc-cleanup
+        name: Remove stale .npmrc file
+        run: rm .npmrc
       - id: npmrc
         name: Setup .npmrc file
         uses: actions/[email protected]
@@ -76,13 +80,18 @@ jobs:
           node-version-file: .nvmrc
           registry-url: https://npm.pkg.github.com
           scope: ${{ github.repository_owner }}
+      - id: npmrc-print
+        name: Print contents of .npmrc file
+        run: cat $NPM_CONFIG_USERCONFIG
       - id: publish
         name: Publish package
         run: npm publish $ARTIFACT ${{ needs.metadata.outputs.dist-tag }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   npm:
     needs: [metadata, gpr]
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     environment:
       name: npm
@@ -95,6 +104,9 @@ jobs:
         uses: actions/[email protected]
         with:
           ref: ${{ format('refs/tags/{0}', env.TAG) }}
+      - id: npmrc-cleanup
+        name: Remove stale .npmrc file
+        run: rm .npmrc
       - id: npmrc
         name: Setup .npmrc file
         uses: actions/[email protected]
@@ -103,6 +115,9 @@ jobs:
           node-version-file: .nvmrc
           registry-url: https://registry.npmjs.org
           scope: ${{ github.repository_owner }}
+      - id: npmrc-print
+        name: Print contents of .npmrc file
+        run: cat $NPM_CONFIG_USERCONFIG
       - id: publish
         name: Publish package
         run: npm publish $ARTIFACT ${{ needs.metadata.outputs.dist-tag }}

.npmrc

@@ -0,0 +1,5 @@
+# https://docs.npmjs.com/cli/configuring-npm/npmrc
+
+@flex-development:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${PAT_BOT}
+//npm.pkg.github.com/:always-auth=true

.yarnrc.yml

@@ -21,7 +21,7 @@ nodeLinker: node-modules
 npmScopes:
   flex-development:
     npmAlwaysAuth: true
-    npmAuthToken: ${GITHUB_TOKEN}
+    npmAuthToken: ${GITHUB_TOKEN:-$PAT_BOT}
     npmRegistryServer: https://npm.pkg.github.com
 
 patchFolder: ./patches

CONTRIBUTING.md

@@ -100,6 +100,7 @@ Follow the steps below to setup your local development environment:
 | `GITHUB_TOKEN`          |
 | `NODE_ENV`              |
 | `NODE_NO_WARNINGS`      |
+| `PAT_BOT`               |
 | `ZSH_DOTENV_FILE`       |
 
 #### GitHub Actions