ci: make package-lock.json registry-agnostic (omit-lockfile-registry-resolved)

Set `omit-lockfile-registry-resolved=true` in ap-web/.npmrc so npm never writes a registry host into the lockfile's `resolved` URLs. Local installs resolve through the Databricks npm proxy, which would otherwise bake that host into the committed lockfile and break reproducibility for contributors without the proxy. This prevents the leak at the source — mirroring how mlflow/mlflow handles its npm lockfiles. Regenerate the lockfile under the flag: 1252 `resolved` URLs are dropped, no version or dependency changes, and every `integrity` hash is kept, so supply-chain tamper protection is unchanged and `npm ci` still verifies. The normalize_npm_lock_registry.py pre-commit hook / CI check stays as a backstop for anyone who regenerates with an npm too old to honor the key. Co-authored-by: Isaac
2026-06-16 22:40:06 +08:00
2 changed files with 11 additions and 1252 deletions
@@ -12,3 +12,14 @@
 # new-enough npm before regenerating; that workflow, not this file, is the
 # real enforcement point.
 min-release-age=7
+
+# Never bake a registry host into the lockfile's `resolved` URLs. Local
+# installs resolve through the Databricks npm proxy, which would otherwise
+# leak that host into the committed lockfile (and break reproducibility for
+# contributors without the proxy). Omitting `resolved` makes the lockfile
+# registry-agnostic — npm resolves against whatever registry is configured
+# at install time — while `integrity` hashes are kept, so tamper protection
+# is unchanged. This prevents the leak at the source; the
+# `normalize_npm_lock_registry.py` pre-commit hook / CI check stays as a
+# backstop for anyone who regenerates with an npm too old to honor this key.
+omit-lockfile-registry-resolved=true