Adding npm_config_registry to ESRPSign

[Vidal Ortega (vidorteg)]

Adding npm_config_registry to ESRPSign pipeline, so that an override can be specified

[Copilot]

🔵 Needs a closer look

The registry override does not cover dependency URLs pinned in package-lock.json.

Pull request overview

Adds a configurable npm registry override to the ESRPSign pipeline.

Changes:

• Defines npm_config_registry using NpmRegistry.
• Defaults to https://registry.npmjs.org/.

File summaries

File	Summary
.github/workflows/ESRPSign.yml	Adds npm registry configuration; dependency URLs pinned in package-lock.json may still bypass the override.

Review details

Suppressed comments (1)

.github/workflows/ESRPSign.yml:22

• This variable does not make the registry override effective for the install as written: npm ci consumes the tarball URLs pinned in package-lock.json, and this lockfile's resolved entries point to https://registry.npmjs.org/. When NpmRegistry is set to another feed, the install can still fetch those URLs directly (or fail if the public registry is unavailable), so the override does not cover the dependencies being installed. The lockfile/install flow needs to rewrite or resolve those URLs against the selected registry as well.

  npm_config_registry: $[coalesce(variables['NpmRegistry'], 'https://registry.npmjs.org/')]

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.