fix(install-node-modules): set NODE_AUTH_TOKEN for the setup-node cache probe

[oscnord]

Did not have push rights to this PR so that is why the PR is created through a fork.

Yarn consumers of install-node-modules have failed on every run since the setup-node v6 to v7 bump in 7d41d76 (2026-09-03):

error Error: Failed to replace env in config: ${NODE_AUTH_TOKEN}
    at NpmRegistry.normalizeConfig (yarn/lib/cli.js:31940)

shapeshifter-smart-tv has been red on every branch since 2026-09-05, including six renovate PRs. Last green run there was 2026-08-31.

Cause

The Setup Node step pairs two inputs that interact:

• registry-url makes setup-node write an .npmrc containing //npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}
• cache makes setup-node shell out to the package manager to locate the cache directory, yarn cache dir for yarn

v7 configures the registry auth before that cache lookup, so the probe reads an .npmrc referencing a variable that the action only sets further down, on Install dependencies.

Yarn treats an .npmrc variable it cannot resolve as fatal. Reproduced against the exact .npmrc setup-node writes:

command	unset NODE_AUTH_TOKEN
yarn cache dir	error Failed to replace env in config
npm config get cache	returns the path
pnpm store path	returns the path

That is why the regression was invisible. Of the repos on this action, the bun ones skip the step entirely via if: manager != 'bun', and the pnpm ones tolerate the unresolved variable. Only yarn breaks, and there is one yarn consumer.

Fix

Set the token on the step that needs it. The install step keeps its own copy, so nothing else changes.

- name: Setup Node
  uses: actions/setup-node@v7
  env:
    NODE_AUTH_TOKEN: ${{ inputs.NPM_TOKEN }}

Verified: with the variable set, yarn cache dir returns the cache path against the identical .npmrc.

npm-install-node-modules delegates here, so it is covered too.

Verification

• actionlint clean.
• install-node-modules/action.yml parses, Setup Node carries the env block.
• Reproduction above run locally against yarn 1.22.22, npm 11.4.2 and pnpm.
• Not yet exercised on a runner. Merging this and unpinning shapeshifter-smart-tv is the real test.

Filed from a fork; I do not have push access here. shapeshifter-smart-tv is pinned to 1db48ea meanwhile, tracked in sfstudios/shapeshifter-smart-tv#647.