Check package-lock.json for wrong addresses

[mbg]

This PR adds a check to make sure that certain URLs that would create issues for some contributors don't end up in package-lock.json.

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

• Testing/None - This change does not impact any CodeQL workflows in production.

How did/will you validate this change?

• Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
• End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Development/testing only - This change cannot cause any failures in production.

How will you know if something goes wrong after this change is released?

• Telemetry - I rely on existing telemetry or have made changes to the telemetry.
  • Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
  • Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

• No special considerations - This change can be merged at any time.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[henrymercer]

We should probably also set min-release-age=7 in .npmrc and remove the @actions/* and actions/* Dependabot cooldown exclusions. This can happen in a separate PR though.

[Copilot]

Copilot review overview

🟢 Approval recommended

The configuration and validation check correctly implement the stated portability safeguard without affecting production workflows.

Review effort: Balanced
Findings: None

What changed in this PR

Makes npm lockfiles registry-agnostic and prevents internal feed URLs from being committed.

Changes:

• Omits registry-resolved URLs from generated lockfiles.
• Adds a PR check rejecting known internal package-feed URLs.

File	Description
.npmrc	Enables registry-agnostic lockfile generation.
.github/​workflows/​pr-checks.yml	Detects internal feed URLs in package-lock.json.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.