From 44f35ffae096191a2d7532a98143014d76b1f7ad Mon Sep 17 00:00:00 2001
From: Jens Meisner <jmeisner@coremedia.com>
Date: Tue, 22 Sep 2026 13:21:32 +0200
Subject: [PATCH 1/4] deleted .npmrc

---
 .npmrc | 1 -
 1 file changed, 1 deletion(-)
 delete mode 100644 .npmrc

diff --git a/.npmrc b/.npmrc
deleted file mode 100644
index a49e127804..0000000000
--- a/.npmrc
+++ /dev/null
@@ -1 +0,0 @@
-strict-ssl=false

From d9f9504b7aa6193a965bf86bc7f159f3bd4ba911 Mon Sep 17 00:00:00 2001
From: Jens Meisner <jmeisner@coremedia.com>
Date: Tue, 22 Sep 2026 13:21:53 +0200
Subject: [PATCH 2/4] updated .gitignore

---
 .gitignore | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.gitignore b/.gitignore
index 628e2219d8..c2f82a7a23 100644
--- a/.gitignore
+++ b/.gitignore
@@ -61,3 +61,12 @@ tmp/
 
 # Results from `pnpm pack` (to test packaging)
 *.tgz
+
+### ----------------------------------------------------------------------------
+### NPM
+### ----------------------------------------------------------------------------
+
+# The .npmrc is generated by the CI workflows (strict-ssl, registry mappings and
+# the Nexus auth token) and must never be committed. Developers may keep their
+# own local variant.
+.npmrc

From 9229817f3dbc8951314f5d7b528c266f4c73e675 Mon Sep 17 00:00:00 2001
From: Jens Meisner <jmeisner@coremedia.com>
Date: Tue, 22 Sep 2026 13:23:44 +0200
Subject: [PATCH 3/4] updated workflows for deleted .npmrc

---
 .github/workflows/build.yml            | 12 +++++++-----
 .github/workflows/deploy-storybook.yml | 12 +++++++-----
 .github/workflows/pre-release-gc.yml   | 12 +++++++++---
 .github/workflows/pre-release.yml      | 16 ++++++++++------
 .github/workflows/release.yml          | 14 ++++++++++----
 .github/workflows/unpublish.yml        | 12 ++++++++++--
 6 files changed, 53 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a70035b460..b152364df5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -92,11 +92,13 @@ jobs:
         name: "Initialize NPM Configuration"
         run: |
           npmAuthToken="${{ env.NODE_AUTH_TOKEN }}"
-          echo "//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=${npmAuthToken}" >> .npmrc
-          echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/" >> .npmrc
-          echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/" >> .npmrc
-          # We must not commit this change.
-          git update-index --assume-unchanged .npmrc
+          # The .npmrc is not checked in (see .gitignore) and fully generated here.
+          {
+            echo "strict-ssl=false"
+            echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=${npmAuthToken}"
+          } > .npmrc
       - id: installPnpm
         name: "Install: Use PNPM ${{ env.pnpmVersion }}"
         uses: pnpm/action-setup@v5
diff --git a/.github/workflows/deploy-storybook.yml b/.github/workflows/deploy-storybook.yml
index 3aceb2a983..75cd4f7374 100644
--- a/.github/workflows/deploy-storybook.yml
+++ b/.github/workflows/deploy-storybook.yml
@@ -76,11 +76,13 @@ jobs:
           npmUrl="${{ env.npmUrl }}"
           npmAuthToken="${{ env.NODE_AUTH_TOKEN }}"
 
-          echo "//${npmHost}/:_authToken=${npmAuthToken}" >> .npmrc
-          echo "@coremedia:registry=${npmUrl}" >> .npmrc
-          echo "@coremedia-internal:registry=${npmUrl}" >> .npmrc
-          # We must not commit this change.
-          git update-index --assume-unchanged .npmrc
+          # The .npmrc is not checked in (see .gitignore) and fully generated here.
+          {
+            echo "strict-ssl=false"
+            echo "@coremedia:registry=${npmUrl}"
+            echo "@coremedia-internal:registry=${npmUrl}"
+            echo "//${npmHost}/:_authToken=${npmAuthToken}"
+          } > .npmrc
       - id: installPnpm
         name: "Install: Use PNPM ${{ env.pnpmVersion }}"
         uses: pnpm/action-setup@v5
diff --git a/.github/workflows/pre-release-gc.yml b/.github/workflows/pre-release-gc.yml
index d2294cf321..493693be62 100644
--- a/.github/workflows/pre-release-gc.yml
+++ b/.github/workflows/pre-release-gc.yml
@@ -57,10 +57,16 @@ jobs:
             exit 1
           fi
           echo "::add-mask::$NPM_AUTH_TOKEN"
-          echo "PNPM_CONFIG_//${{ env.NPM_REPOSITORY }}/:_authToken=${NPM_AUTH_TOKEN}" >> $GITHUB_ENV
           echo "NPM_AUTH_TOKEN=${NPM_AUTH_TOKEN}" >> $GITHUB_ENV
-          echo "//${{ env.NPM_REPOSITORY }}/:_authToken=${NPM_AUTH_TOKEN}" > .npmrc
-          echo "@coremedia:registry=${{ env.NPM_REPOSITORY_URL }}" >> .npmrc
+          # The .npmrc is not checked in (see .gitignore) and fully generated here.
+          # pnpm ignores ${VAR} placeholders in registry credentials that come from
+          # a project .npmrc, so the resolved token has to be written out literally.
+          # The file is gitignored and the token is masked in the logs.
+          {
+            echo "strict-ssl=false"
+            echo "@coremedia:registry=${{ env.NPM_REPOSITORY_URL }}"
+            echo "//${{ env.NPM_REPOSITORY }}/:_authToken=${NPM_AUTH_TOKEN}"
+          } > .npmrc
       - name: "Performing Garbage Collection (retain: ${{ inputs.retain }}, dry-run: ${{ inputs.dryRun }})"
         run: |
           packages=($(npm search "@coremedia/ckeditor" --json --registry "${{ env.NPM_REPOSITORY_URL }}" | jq -r ".[].name"))
diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml
index ebfbdcedf7..830b94989e 100644
--- a/.github/workflows/pre-release.yml
+++ b/.github/workflows/pre-release.yml
@@ -54,9 +54,16 @@ jobs:
           fi
           echo "::add-mask::$NPM_AUTH_TOKEN"
           echo "NPM_AUTH_TOKEN=$NPM_AUTH_TOKEN" >> $GITHUB_ENV
-          echo "PNPM_CONFIG_//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN" >> $GITHUB_ENV
-          echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/" >> .npmrc
-          echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/" >> .npmrc
+          # The .npmrc is not checked in (see .gitignore) and fully generated here.
+          # pnpm ignores ${VAR} placeholders in registry credentials that come from
+          # a project .npmrc, so the resolved token has to be written out literally.
+          # The file is gitignored and the token is masked in the logs.
+          {
+            echo "strict-ssl=false"
+            echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN"
+          } > .npmrc
       - name: Setup Git
         run: |
           git config --global user.name 'coremedia-ci'
@@ -104,7 +111,6 @@ jobs:
         if: github.event_name == 'workflow_dispatch'
         run: |
           pnpm install --production
-          echo '//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=${NPM_AUTH_TOKEN}' > .npmrc
           pnpm publishall --registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/ --no-git-checks --tag pullrequest
       # The "Set prerelease version" step pinned all @coremedia/* interdependencies
       # to concrete versions so they could be published. Now that publishing is done,
@@ -113,8 +119,6 @@ jobs:
       - name: Restore workspace dependency versions
         if: github.event_name == 'workflow_dispatch'
         run: |
-          # Avoid committing the auth token written to .npmrc during publishing.
-          git checkout -- .npmrc || true
           echo "Restoring workspace dependency versions for: ${NEXT_VERSION}"
           pnpm run setversion ${NEXT_VERSION} --filter=coremedia/* --dependencyVersion=workspace:^${NEXT_VERSION}
           pnpm install --no-frozen-lockfile
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 338b9cf41b..24085740fa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -73,9 +73,16 @@ jobs:
           fi
           echo "::add-mask::$NPM_AUTH_TOKEN"
           echo "NPM_AUTH_TOKEN=$NPM_AUTH_TOKEN" >> $GITHUB_ENV
-          echo "PNPM_CONFIG_//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN" >> $GITHUB_ENV
-          echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/" >> .npmrc
-          echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/" >> .npmrc
+          # The .npmrc is not checked in (see .gitignore) and fully generated here.
+          # pnpm ignores ${VAR} placeholders in registry credentials that come from
+          # a project .npmrc, so the resolved token has to be written out literally.
+          # The file is gitignored and the token is masked in the logs.
+          {
+            echo "strict-ssl=false"
+            echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN"
+          } > .npmrc
       - name: Setup Git
         run: |
           git config --global user.name 'coremedia-ci'
@@ -135,7 +142,6 @@ jobs:
       - name: Publish Release
         if: github.event_name == 'workflow_dispatch'
         run: |
-          echo '//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=${NPM_AUTH_TOKEN}' > .npmrc
           pnpm publishall --registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/ --no-git-checks
           git reset --hard
       # The "Create Release Version" step pinned all @coremedia/* interdependencies
diff --git a/.github/workflows/unpublish.yml b/.github/workflows/unpublish.yml
index ffc709b183..7179277427 100644
--- a/.github/workflows/unpublish.yml
+++ b/.github/workflows/unpublish.yml
@@ -20,9 +20,17 @@ jobs:
             exit 1
           fi
           echo "::add-mask::$NPM_AUTH_TOKEN"
-          echo "PNPM_CONFIG_//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN" >> $GITHUB_ENV
           echo "NPM_AUTH_TOKEN=$NPM_AUTH_TOKEN" >> $GITHUB_ENV
-          echo '//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=${NPM_AUTH_TOKEN}' > .npmrc
+          # The .npmrc is not checked in (see .gitignore) and fully generated here.
+          # pnpm ignores ${VAR} placeholders in registry credentials that come from
+          # a project .npmrc, so the resolved token has to be written out literally.
+          # The file is gitignored and the token is masked in the logs.
+          {
+            echo "strict-ssl=false"
+            echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN"
+          } > .npmrc
       - name: Unpublish release
         run: |
           version=${{ github.event.inputs.version }}

From 33c46dd103441c4048de6fe2c25a3ea667f0376e Mon Sep 17 00:00:00 2001
From: Jens Meisner <jmeisner@coremedia.com>
Date: Tue, 22 Sep 2026 13:33:12 +0200
Subject: [PATCH 4/4] removed strict-ssl=false

---
 .github/workflows/build.yml            | 1 -
 .github/workflows/deploy-storybook.yml | 1 -
 .github/workflows/pre-release-gc.yml   | 1 -
 .github/workflows/pre-release.yml      | 1 -
 .github/workflows/release.yml          | 1 -
 .github/workflows/unpublish.yml        | 1 -
 6 files changed, 6 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b152364df5..9a3ea2ef5c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -94,7 +94,6 @@ jobs:
           npmAuthToken="${{ env.NODE_AUTH_TOKEN }}"
           # The .npmrc is not checked in (see .gitignore) and fully generated here.
           {
-            echo "strict-ssl=false"
             echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
             echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
             echo "//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=${npmAuthToken}"
diff --git a/.github/workflows/deploy-storybook.yml b/.github/workflows/deploy-storybook.yml
index 75cd4f7374..64723c82ee 100644
--- a/.github/workflows/deploy-storybook.yml
+++ b/.github/workflows/deploy-storybook.yml
@@ -78,7 +78,6 @@ jobs:
 
           # The .npmrc is not checked in (see .gitignore) and fully generated here.
           {
-            echo "strict-ssl=false"
             echo "@coremedia:registry=${npmUrl}"
             echo "@coremedia-internal:registry=${npmUrl}"
             echo "//${npmHost}/:_authToken=${npmAuthToken}"
diff --git a/.github/workflows/pre-release-gc.yml b/.github/workflows/pre-release-gc.yml
index 493693be62..1ae157663d 100644
--- a/.github/workflows/pre-release-gc.yml
+++ b/.github/workflows/pre-release-gc.yml
@@ -63,7 +63,6 @@ jobs:
           # a project .npmrc, so the resolved token has to be written out literally.
           # The file is gitignored and the token is masked in the logs.
           {
-            echo "strict-ssl=false"
             echo "@coremedia:registry=${{ env.NPM_REPOSITORY_URL }}"
             echo "//${{ env.NPM_REPOSITORY }}/:_authToken=${NPM_AUTH_TOKEN}"
           } > .npmrc
diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml
index 830b94989e..f808af454f 100644
--- a/.github/workflows/pre-release.yml
+++ b/.github/workflows/pre-release.yml
@@ -59,7 +59,6 @@ jobs:
           # a project .npmrc, so the resolved token has to be written out literally.
           # The file is gitignored and the token is masked in the logs.
           {
-            echo "strict-ssl=false"
             echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
             echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
             echo "//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 24085740fa..633e76ec70 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -78,7 +78,6 @@ jobs:
           # a project .npmrc, so the resolved token has to be written out literally.
           # The file is gitignored and the token is masked in the logs.
           {
-            echo "strict-ssl=false"
             echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
             echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
             echo "//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN"
diff --git a/.github/workflows/unpublish.yml b/.github/workflows/unpublish.yml
index 7179277427..1ed914ce4d 100644
--- a/.github/workflows/unpublish.yml
+++ b/.github/workflows/unpublish.yml
@@ -26,7 +26,6 @@ jobs:
           # a project .npmrc, so the resolved token has to be written out literally.
           # The file is gitignored and the token is masked in the logs.
           {
-            echo "strict-ssl=false"
             echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
             echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
             echo "//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN"