Fix Dependabot npm registry context

[bcdonadio]

Summary

Add a checked-in .npmrc that declares the public npm registry for this package.

Root Cause

The latest Dependabot Updates run failed before it could process the open security updates. Dependabot automatically added a GitHub Packages credential for npm.pkg.github.com, but this repository did not have package-manager registry context via .npmrc or explicit npm registry routing. The run aborted with private_registry_config_not_found for npm.pkg.github.com.

The current lockfile resolves npm packages from https://registry.npmjs.org/, so the narrow fix is to make that registry explicit for npm rather than routing all npm traffic through GitHub Packages.

Validation

• npm config get registry
• parsed .github/dependabot.yml with js-yaml
• npm ci
• npm run build
• npm test

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2dae8635-e1c6-4110-8566-863929ff22ca

📥 Commits

Reviewing files that changed from the base of the PR and between 6f68b54 and be70de2.

📒 Files selected for processing (1)

• .npmrc

📜 Recent review details

⏰ Context from checks skipped due to timeout. (5)

• GitHub Check: copilot-pull-request-reviewer
• GitHub Check: ci
• GitHub Check: Analyze (javascript-typescript)
• GitHub Check: Analyze (javascript-typescript)
• GitHub Check: Analyze (actions)

🔇 Additional comments (1)

.npmrc (1)

1-1: LGTM!

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated package configuration to use the official npm registry by default.

Walkthrough

The PR adds an .npmrc entry that sets the npm registry to https://registry.npmjs.org/.

Changes

NPM registry configuration

Layer / File(s)	Summary
Registry setting .npmrc	The repository npm configuration now sets the package registry to https://registry.npmjs.org/.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 Hop, hop, a registry tune,
One tiny line beneath the moon.
The npm path is set just right,
Packages scamper through the night.
Bun-bun nods: “All neat and bright!”

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: adding npm registry context for Dependabot.
Description check	✅ Passed	The description includes a clear summary, root cause, and validation steps, which covers the template's core sections.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependabot-npm-registry-context

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR fixes Dependabot’s npm registry context by checking in a repo-level .npmrc that explicitly sets the default npm registry to the public npm registry, avoiding unintended routing/credential expectations for GitHub Packages.

Changes:

• Add a checked-in .npmrc with registry=https://registry.npmjs.org/ to provide explicit registry context for npm tooling (including Dependabot).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!