npm registries as a built-in format plugin: hosted, proxy and group repositories with npm login

.github/scripts/ci-changes.sh

@@ -42,7 +42,7 @@ CI=.github/workflows/ci.yml
 declare -A CI_JOB_GROUP=(
     [fmt]=changelog [clippy]=rust [audit]=audit [test]=rust
     [docker-platform]=image [docker]=image [kubernetes]=kubernetes [web]=web
-    [oci-e2e]=rust [raw-e2e]=rust [e2e]=rust [web-e2e]=web
+    [oci-e2e]=rust [raw-e2e]=rust [npm-e2e]=rust [e2e]=rust [web-e2e]=web
 )
 
 # Rust: the workspace, what its build and tests read from outside the crates
@@ -55,7 +55,7 @@ RUST=(
     web/index.html docker/forge.docker.toml
     .github/scripts/test-parallel.sh .github/scripts/test-timings-runner.sh
     .github/scripts/test-timings-summary.sh .github/scripts/oci-e2e.sh
-    .github/scripts/raw-e2e.sh
+    .github/scripts/raw-e2e.sh .github/scripts/npm-e2e.sh
 )
 # fmt's second check: the changelog fragments.
 CHANGELOG=(docs/changes)

.github/workflows/ci.yml

@@ -577,7 +577,8 @@ jobs:
       - name: Cache cargo registry + dependency builds
         uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
-          # raw-e2e, oci-e2e and web-e2e build the same debug forge-server.
+          # raw-e2e, npm-e2e, oci-e2e and web-e2e build the same debug
+          # forge-server.
           shared-key: forge-server
           save-if: false
       - name: Start the S3 gateway
@@ -597,6 +598,71 @@ jobs:
           path: raw-e2e-results
           retention-days: 7
 
+  # ── npm registries e2e (npm, pnpm and Yarn against a live server) ─────────
+  # Boots forge-server and a mock upstream registry, and drives npm
+  # repositories with the real clients: npm's web login and Yarn's legacy
+  # login, logout, publishes with npm and pnpm (also through a group to its
+  # writable member), installs from a hosted repository, a proxy and a group,
+  # dist-tags, deprecation, unpublishing, the group's dependency-confusion
+  # guard and npm audit (.github/scripts/npm-e2e.sh).
+  npm-e2e:
+    name: npm-e2e
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ !cancelled() && needs.changes.outputs.rust != 'false' }}
+    services:
+      postgres:
+        image: mirror.gcr.io/library/postgres:17@sha256:a63c1ea3f6a3a5a1621f97d2aba3b30faecfab4224c1b0000cc85ced57bb1939
+        env:
+          POSTGRES_DB: forge
+          POSTGRES_USER: forge
+          POSTGRES_PASSWORD: forge
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U forge -d forge"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      SQLX_OFFLINE: "true"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Rust toolchain (rust-toolchain.toml)
+        uses: dtolnay/rust-toolchain@d124f86f28ff42855784ff3319f48ac182c248f8 # 1.99.1
+      - name: Cache cargo registry + dependency builds
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          # npm-e2e, raw-e2e, oci-e2e and web-e2e build the same debug
+          # forge-server.
+          shared-key: forge-server
+          save-if: false
+      - name: Setup pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          version: "11.5.0"
+          package_json_file: web/package.json
+      - name: Setup Node 26
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "26"
+      - name: Start the S3 gateway
+        run: |
+          docker run -d --name forge-e2e-s3 -p 7070:7070 \
+            mirror.gcr.io/versity/versitygw:v1.4.1@sha256:0400cb59f59da0f1cf9f7fd49505191abc348dfadf54509bf1988caaff4eb96f \
+            --port :7070 --access forge-e2e-key --secret forge-e2e-secret posix /tmp
+      - name: cargo build -p forge-server
+        run: cargo build -p forge-server --bin forge-server
+      - name: npm e2e with npm, pnpm and Yarn (logins, publish, install, tags, audit)
+        run: .github/scripts/npm-e2e.sh target/debug/forge-server npm-e2e-results
+      - name: Upload the server and upstream logs
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: npm-e2e-results
+          path: npm-e2e-results
+          retention-days: 7
+
   # ── E2E / integration tests (forge-e2e crate, testcontainers) ──────────────
   # The forge-e2e harness boots its OWN Postgres + versitygw (+ Redis, and a
   # versitygw with its IAM/STS service for the S3 web identity scenarios)

.github/workflows/release.yml

@@ -90,7 +90,7 @@ jobs:
       DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
       # The `name:` of every ci.yml job that runs on the default branch. The
       # required status checks in DEVELOPMENT.md (merge queue) list the same.
-      REQUIRED_JOBS: fmt clippy audit test docker kubernetes web oci-e2e raw-e2e e2e web-e2e
+      REQUIRED_JOBS: fmt clippy audit test docker kubernetes web oci-e2e raw-e2e npm-e2e e2e web-e2e
     steps:
       - name: Wait for the commit's CI run and check its jobs
         shell: bash # -eo pipefail: a failing gh call fails the step