build: stop recording npm registry URLs in lockfiles

[Jamie Magee (JamieMagee)]

Purpose

• Add omit-lockfile-registry-resolved=true in chat-app/frontend and scenario-app/frontend.
• Remove registry resolved fields from both lockfiles without changing dependency metadata or lockfile version 3.

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone https://github.com/JamieMagee/customer-chatbot-solution-accelerator.git
cd customer-chatbot-solution-accelerator
git checkout fix/omit-lockfile-registry-resolved

• Test the code

cd chat-app/frontend
npm ci --legacy-peer-deps
npm run build

cd ../../scenario-app/frontend
npm ci --legacy-peer-deps
npm run build

What to Check

Verify that the following are valid

• npm config get omit-lockfile-registry-resolved returns true in both frontend roots.
• Both lockfiles contain no Azure Artifacts feed URLs.
• A second remediation pass makes no lockfile changes.
• Both production builds complete successfully.

Other Information

• Open PR #347 touches the same files but sets an Azure Artifacts registry. It does not implement this remediation.
• Open Dependabot PR #311 also updates the scenario frontend lockfile.

[Copilot]

Pull request overview

This PR updates npm configuration for both frontends so package-lock.json files no longer record registry download URLs (e.g., Azure Artifacts feed URLs), reducing lockfile churn and preventing registry URL leakage while keeping lockfileVersion at 3.

Changes:

• Add omit-lockfile-registry-resolved=true via .npmrc in chat-app/frontend and scenario-app/frontend.
• Remove all resolved registry entries from both package-lock.json files (dependency versions/integrity preserved).

Show a summary per file

File	Description
chat-app/frontend/.npmrc	Enables omitting registry-resolved URLs in the chat frontend lockfile.
chat-app/frontend/package-lock.json	Removes resolved URL fields from the chat frontend lockfile while keeping lockfile v3.
scenario-app/frontend/.npmrc	Enables omitting registry-resolved URLs in the scenario frontend lockfile.
scenario-app/frontend/package-lock.json	Removes resolved URL fields from the scenario frontend lockfile while keeping lockfile v3.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 2/4 changed files
• Comments generated: 0
• Review effort level: Lite