BUILD-10889: config-npm to pull npm packages from repox

[hedinasr]

Part of https://sonarsource.atlassian.net/browse/BUILD-10889.

[hashicorp-vault-sonar-prod]

BUILD-10889

[sonar-review-alpha]

Summary

This PR adds a single GitHub Actions step to configure npm to pull packages from repox instead of the default registry. The step uses the config-npm action from SonarSource's shared CI actions and is inserted in the upload-actual workflow, before the "Generate Diff Report" step. The configuration is skipped on Windows runners to avoid platform-specific issues.

What reviewers should know

What to review:

• The change is minimal: one new workflow step in .github/actions/upload-actual/action.yml
• The step invokes an external action (SonarSource/ci-github-actions/config-npm@v1) — the actual npm configuration logic lives there, not in this repo
• The if: runner.os != 'Windows' condition is intentional and reasonable for npm tooling compatibility

Context:

• This is part of a larger effort (BUILD-10889) to standardize npm registry configuration across CI pipelines
• The step runs early in the artifact upload flow, ensuring npm is configured before any downstream steps that might need package installation
• No other files or workflows are affected by this change

No testing visible in the diff — verify that existing CI runs successfully with this new step enabled.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[tomasz-tylenda-sonarsource]

LGTM. Test run is https://github.com/SonarSource/sonar-java/actions/runs/24197708489 - it generated expected diff files.

[sonar-review-alpha]

LGTM! ✅

Clean, minimal change. The config-npm step is correctly placed before npx diff2html-cli in the Generate Diff Report step, which is the sole consumer of npm packages in this action. The Windows guard is consistent with the rest of the action (the bash shell step also implicitly targets non-Windows). No issues found.

🗣️ Give feedback