chore(ci): cover every .npmrc in the hook, and clean up the registry config

Follow-ups from the review of #414.

The credential guard now checks each staged .npmrc rather than only the client
one: the root and sas/ files are tracked policy as well, so a token pasted into
either was equally one `git add -A` away. Verified by staging a token in
sas/.npmrc - the hook exits 1.

$RUNNER_TEMP/npmrc is removed at the end of each job that writes it, with
`if: always()` so a failed job cleans up too.

The root `install` script is gone: the root .npmrc sets ignore-scripts, so npm
never ran it. CONTRIBUTING already spells out the per-project commands, and is
now the single source.

The release workflows build the published client from the same tree, so they run
`check:archiver` like build.yaml does.

.git-hooks/pre-commit

@@ -20,16 +20,15 @@ if ! "$gitleaks_bin" protect --staged --redact; then
     exit 1
 fi
 
-# client/.npmrc is a tracked policy file. A registry credential belongs in the
-# user config (~/.npmrc or NPM_CONFIG_USERCONFIG), because one `git add -A`
-# would otherwise commit it - and the CI pattern that used to write the token
-# into this path is exactly the habit that makes it likely.
-if git diff --cached --name-only --diff-filter=ACMR | grep -qx 'client/.npmrc'; then
-    if git show :client/.npmrc | grep -Eq '(_authToken|_auth[^a-z]|_password|:_auth)'; then
-        echo "ERROR: client/.npmrc holds a registry credential - keep it in ~/.npmrc instead"
+# Every tracked .npmrc is a policy file - root, sas/ and client/ - so a registry
+# credential pasted into any of them is one `git add -A` from being committed.
+# Each staged one is checked, not just the client.
+for npmrc in $(git diff --cached --name-only --diff-filter=ACMR | grep -E '(^|/)\.npmrc$'); do
+    if git show ":$npmrc" | grep -Eq '(_authToken|_auth[^a-z]|_password|:_auth)'; then
+        echo "ERROR: $npmrc holds a registry credential - keep it in ~/.npmrc instead"
         exit 1
     fi
-fi
+done
 
 ## Avoid large commits
 # https://www.backblaze.com/blog/how-many-bytes-are-in-a-megabyte-really/

.gitea/workflows/build.yaml

@@ -121,6 +121,11 @@ jobs:
   # limits how far sharding helps.  The specs it runs come from
   # .gitea/scripts/cypress-specs.sh.
 
+      - name: Remove registry config
+        # written earlier in this job; nothing deletes it on the way out
+        if: always()
+        run: rm -f "$RUNNER_TEMP/npmrc"
+
   Build-and-test-development:
     runs-on: ubuntu-latest
     needs: Build-and-ng-test
@@ -291,3 +296,8 @@ jobs:
         with:
           name: cypress-videos.zip
           path: cypress-videos.zip
+
+      - name: Remove registry config
+        # written earlier in this job; nothing deletes it on the way out
+        if: always()
+        run: rm -f "$RUNNER_TEMP/npmrc"

.gitea/workflows/docs.yaml

@@ -80,6 +80,11 @@ jobs:
             --password "$SURFER_PASSWORD" \
             --message "Typedoc from ${REF_NAME} @ ${COMMIT_SHA:0:8}"
 
+      - name: Remove registry config
+        # written earlier in this job; nothing deletes it on the way out
+        if: always()
+        run: rm -f "$RUNNER_TEMP/npmrc"
+
   sas-docs:
     runs-on: ubuntu-latest
     concurrency:

.gitea/workflows/lighthouse.yaml

@@ -127,3 +127,8 @@ jobs:
           name: Lighthouse results
           path: client/lighthouse-reports
           include-hidden-files: true
+
+      - name: Remove registry config
+        # written earlier in this job; nothing deletes it on the way out
+        if: always()
+        run: rm -f "$RUNNER_TEMP/npmrc"

.gitea/workflows/release-assets.yaml

@@ -211,3 +211,8 @@ jobs:
           done
           echo "Uploading SHA256SUMS ..."
           curl --fail-with-body -sS -H "$AUTH_HEADER" "$URL" -F "attachment=@SHA256SUMS"
+
+      - name: Remove registry config
+        # written earlier in this job; nothing deletes it on the way out
+        if: always()
+        run: rm -f "$RUNNER_TEMP/npmrc"

.gitea/workflows/release.yaml

@@ -72,8 +72,14 @@ jobs:
         run: |
           cd client
           npm run postinstall
+          npm run check:archiver
           npm run build
 
+      - name: Remove registry config
+        # written earlier in this job; nothing deletes it on the way out
+        if: always()
+        run: rm -f "$RUNNER_TEMP/npmrc"
+
   Build-and-test-development:
     runs-on: ubuntu-latest
     needs: Build-production-and-ng-test
@@ -226,6 +232,11 @@ jobs:
           name: cypress-videos.zip
           path: cypress-videos.zip
 
+      - name: Remove registry config
+        # written earlier in this job; nothing deletes it on the way out
+        if: always()
+        run: rm -f "$RUNNER_TEMP/npmrc"
+
   release:
     runs-on: ubuntu-latest
     needs: [Build-production-and-ng-test, Build-and-test-development]
@@ -493,3 +504,8 @@ jobs:
             -H 'Content-Type: application/json' \
             --data "$(jq -n --arg ref "refs/tags/$TAG" '{ref: $ref}')" \
             "$BASE/actions/workflows/sites.yaml/dispatches"
+
+      - name: Remove registry config
+        # written earlier in this job; nothing deletes it on the way out
+        if: always()
+        run: rm -f "$RUNNER_TEMP/npmrc"

.gitea/workflows/sites.yaml

@@ -201,3 +201,8 @@ jobs:
             --message "$MESSAGE" \
             "${SITE_ARGS[@]}" \
             sas/mocks/sasjsbuild/mock
+
+      - name: Remove registry config
+        # written earlier in this job; nothing deletes it on the way out
+        if: always()
+        run: rm -f "$RUNNER_TEMP/npmrc"

package.json

@@ -15,7 +15,6 @@
     "got": "11.8.6"
   },
   "scripts": {
-    "install": "cd client && npm i && npm run postinstall && cd ../sas && npm i",
     "build-frontend": "cd client && npm run build",
     "lint": "cd client && npm run lint",
     "lint:fix": "cd client && npm run lint:fix",