From 9df18983c37fdbbd9177774413e71f31ffad7e7a Mon Sep 17 00:00:00 2001
From: Deac <deac@pixelparasol.com>
Date: Thu, 17 Sep 2026 11:48:24 -0400
Subject: [PATCH] STAT-133: Add NPM_TOKEN support to node and test/npm actions
 for private registry auth

npm ci fails with E401 when a consuming repo's package-lock.json pins a
package to the private Gitea npm registry, since these composite actions
never write an .npmrc or set a registry auth token. Add an optional
NPM_TOKEN input that writes .npmrc before install; existing consumers that
don't pass it are unaffected.
---
 node/README.md      |  1 +
 node/action.yml     | 13 +++++++++++++
 test/npm/README.md  | 10 ++++++++++
 test/npm/action.yml | 13 +++++++++++++
 4 files changed, 37 insertions(+)

diff --git a/node/README.md b/node/README.md
index 8bfc5eb..2c9f942 100644
--- a/node/README.md
+++ b/node/README.md
@@ -19,6 +19,7 @@ Install dependencies, build, and upload a build artifact
 | `COPY_PRISMA_ENGINE` | <p>Copy the Prisma query engine binaries into the build directory</p> | `false` | `false` |
 | `WORKING_DIRECTORY` | <p>Working directory for install, build, and artifact steps</p> | `false` | `.` |
 | `UPLOAD_ARTIFACT` | <p>Whether to upload the build artifact</p> | `false` | `true` |
+| `NPM_TOKEN` | <p>Auth token for the private Gitea npm registry (@stat-tackler scope). Leave empty if the repo installs no private packages.</p> | `false` | `""` |
 <!-- action-docs-inputs source="action.yml" -->
 
 <!-- action-docs-runs source="action.yml" -->
diff --git a/node/action.yml b/node/action.yml
index 3c49a4c..1b4793e 100644
--- a/node/action.yml
+++ b/node/action.yml
@@ -25,6 +25,9 @@ inputs:
   UPLOAD_ARTIFACT:
     description: "Whether to upload the build artifact"
     default: "true"
+  NPM_TOKEN:
+    description: "Auth token for the private Gitea npm registry (@stat-tackler scope). Leave empty if the repo installs no private packages."
+    default: ""
 
 runs:
   using: composite
@@ -36,6 +39,16 @@ runs:
       with:
         node-version-file: ${{ inputs.WORKING_DIRECTORY }}/package.json
 
+    - name: Configure private registry auth
+      if: inputs.NPM_TOKEN != ''
+      shell: sh
+      working-directory: ${{ inputs.WORKING_DIRECTORY }}
+      run: |
+        printf '%s\n%s\n' \
+          '@stat-tackler:registry=https://gitea.pixelparasol.com/api/packages/stat-tackler/npm/' \
+          '//gitea.pixelparasol.com/api/packages/stat-tackler/npm/:_authToken=${{ inputs.NPM_TOKEN }}' \
+          >> .npmrc
+
     - name: Install
       shell: sh
       working-directory: ${{ inputs.WORKING_DIRECTORY }}
diff --git a/test/npm/README.md b/test/npm/README.md
index 3d8f364..5374d05 100644
--- a/test/npm/README.md
+++ b/test/npm/README.md
@@ -10,6 +10,7 @@ Composite action: install dependencies and run an npm test script.
 | `TEST_SCRIPT` | npm script to run (must exist in `package.json`) | `test` |
 | `TEST_ARGS` | Additional arguments passed after `--` to the test script | `` |
 | `WORKING_DIRECTORY` | Directory to run commands in | `.` |
+| `NPM_TOKEN` | Auth token for the private Gitea npm registry (`@stat-tackler` scope). Leave empty if the repo installs no private packages. | `` |
 
 ## Usage
 
@@ -19,6 +20,15 @@ Composite action: install dependencies and run an npm test script.
     TEST_SCRIPT: test:unit
 ```
 
+With a private `@stat-tackler` package in `package.json`:
+
+```yaml
+- uses: stat-tackler/stat-tackler-infra/test/npm@main
+  with:
+    TEST_SCRIPT: test:unit
+    NPM_TOKEN: ${{ secrets.REGISTRY_READ_WRITE_AGENT }}
+```
+
 With extra args:
 
 ```yaml
diff --git a/test/npm/action.yml b/test/npm/action.yml
index eb9992c..dd2bed6 100644
--- a/test/npm/action.yml
+++ b/test/npm/action.yml
@@ -14,6 +14,9 @@ inputs:
   WORKING_DIRECTORY:
     description: "Directory to run commands in"
     default: "."
+  NPM_TOKEN:
+    description: "Auth token for the private Gitea npm registry (@stat-tackler scope). Leave empty if the repo installs no private packages."
+    default: ""
 
 runs:
   using: composite
@@ -32,6 +35,16 @@ runs:
         key: node-modules-${{ hashFiles(format('{0}/package-lock.json', inputs.WORKING_DIRECTORY)) }}
         restore-keys: node-modules-
 
+    - name: Configure private registry auth
+      if: inputs.NPM_TOKEN != ''
+      shell: sh
+      working-directory: ${{ inputs.WORKING_DIRECTORY }}
+      run: |
+        printf '%s\n%s\n' \
+          '@stat-tackler:registry=https://gitea.pixelparasol.com/api/packages/stat-tackler/npm/' \
+          '//gitea.pixelparasol.com/api/packages/stat-tackler/npm/:_authToken=${{ inputs.NPM_TOKEN }}' \
+          >> .npmrc
+
     - name: Install
       shell: sh
       working-directory: ${{ inputs.WORKING_DIRECTORY }}
-- 
2.54.0