dc c033032e26 chore(ci): cover every .npmrc in the hook, and clean up the registry config ...

Follow-ups from the review of #414.

The credential guard now checks each staged .npmrc rather than only the client
one: the root and sas/ files are tracked policy as well, so a token pasted into
either was equally one `git add -A` away. Verified by staging a token in
sas/.npmrc - the hook exits 1.

$RUNNER_TEMP/npmrc is removed at the end of each job that writes it, with
`if: always()` so a failed job cleans up too.

The root `install` script is gone: the root .npmrc sets ignore-scripts, so npm
never ran it. CONTRIBUTING already spells out the per-project commands, and is
now the single source.

The release workflows build the published client from the same tree, so they run
`check:archiver` like build.yaml does.

2026-10-31 09:55:31 +00:00

..

commit-msg

init

2023-07-13 13:44:05 +02:00

pre-commit

chore(ci): cover every .npmrc in the hook, and clean up the registry config

2026-10-31 09:55:31 +00:00