ci: rewrite lockfile resolved: URLs to JFrog in setup-jfrog

npm ci honors the lockfile's resolved: URL over .npmrc's registry
setting. Protected runners cannot reach registry.npmjs.org directly,
so any package not already in the ~/.npm cache hangs ~8 minutes
before being killed with "Exit handler never called", which silently
skips bin-linking and breaks downstream `nyc`/`prettier` calls.

Rewrite the lockfile in-place after configuring the JFrog registry
so npm fetches via the proxy. Committed lockfile stays in standard
public-npm form so contributors can `npm ci` locally without JFrog
auth.

Co-authored-by: Isaac
Signed-off-by: Vikrant Puppala <vikrant.puppala@databricks.com>

Author: vikrantpuppala

.github/actions/setup-jfrog/action.yml

@@ -34,3 +34,21 @@ runs:
         always-auth=true
         EOF
         echo "npm configured to use JFrog registry"
+
+    # Rewrite lockfile `resolved:` URLs to JFrog. `npm ci` honors the
+    # lockfile's `resolved:` URL over the `.npmrc` registry; protected
+    # runners cannot reach `registry.npmjs.org` directly, so without
+    # this rewrite npm hangs ~8 minutes on any package not already in
+    # the `~/.npm` cache, then dies with "Exit handler never called".
+    # The committed lockfile is kept in standard form (public-npm URLs)
+    # so contributors can `npm ci` locally; this step adapts it for CI.
+    - name: Rewrite lockfile to JFrog registry
+      shell: bash
+      run: |
+        set -euo pipefail
+        if [ -f package-lock.json ]; then
+          sed -i 's|https://registry.npmjs.org|https://databricks.jfrog.io/artifactory/api/npm/db-npm|g' package-lock.json
+          echo "package-lock.json resolved: URLs rewritten to JFrog"
+        else
+          echo "no package-lock.json found; skipping rewrite"
+        fi