chore(dependencies): update package-lock.json to switch resolved URLs to npm registry (#1181)

Author: kimpenhaus

.github/workflows/dotnet-pre-release.yml

@@ -42,10 +42,10 @@ jobs:
 
       - name: Setup Semantic Release
         run: |
-          # semantic-release is pulled from a Git fork; npm pins it as git+ssh in the
-          # lockfile, so rewrite to anonymous HTTPS (the CI runner has no SSH key).
-          git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
-          npm ci
+          # --ignore-scripts blocks all dependencies' lifecycle scripts; the one
+          # patch we need is then applied explicitly via patch-package.
+          npm ci --ignore-scripts
+          npx patch-package
         working-directory: ./.release
 
       - name: Semantic Release

.github/workflows/dotnet-release.yml

@@ -41,10 +41,10 @@ jobs:
 
       - name: Setup Semantic Release
         run: |
-          # semantic-release is pulled from a Git fork; npm pins it as git+ssh in the
-          # lockfile, so rewrite to anonymous HTTPS (the CI runner has no SSH key).
-          git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
-          npm ci
+          # --ignore-scripts blocks all dependencies' lifecycle scripts; the one
+          # patch we need is then applied explicitly via patch-package.
+          npm ci --ignore-scripts
+          npx patch-package
         working-directory: ./.release
 
       - name: Semantic Release

.release/.npmrc

@@ -0,0 +1,2 @@
+# Pin the release toolchain to the public npm registry.
+registry=https://registry.npmjs.org/