fix(ci): isolate npm release configuration

scripts/verify-schema-v3-only-release.sh

@@ -3,14 +3,12 @@
 # dependencies come from backend/package-lock.json and dist comes from a clean build.
 set -euo pipefail
 export PYTHONDONTWRITEBYTECODE=1
-export NPM_CONFIG_USERCONFIG=/dev/null
-export NPM_CONFIG_GLOBALCONFIG=/dev/null
 root="$(cd "$(dirname "$0")/.." && pwd -P)"
 if [[ ${1:-} == --dry-run ]]; then
   cat <<'EOF'
 export PYTHONDONTWRITEBYTECODE=1
-export NPM_CONFIG_USERCONFIG=/dev/null
-export NPM_CONFIG_GLOBALCONFIG=/dev/null
+export NPM_CONFIG_USERCONFIG=<private-empty-user-config>
+export NPM_CONFIG_GLOBALCONFIG=<private-empty-global-config>
 /bin/bash scripts/verify-schema-v3-only.sh --bootstrap-trust-only
 (cd backend && npm ci --ignore-scripts)
 (cd backend && npm run build)
@@ -21,6 +19,13 @@ EOF
   exit 0
 fi
 [[ $# -eq 0 ]] || { echo "usage: $0 [--dry-run]" >&2; exit 2; }
+release_tmp="$(mktemp -d "${TMPDIR:-/tmp}/thoth-v3-release.XXXXXX")"
+trap 'rm -rf "$release_tmp"' EXIT HUP INT TERM
+: >"$release_tmp/npm-userconfig"
+: >"$release_tmp/npm-globalconfig"
+chmod 0600 "$release_tmp/npm-userconfig" "$release_tmp/npm-globalconfig"
+export NPM_CONFIG_USERCONFIG="$release_tmp/npm-userconfig"
+export NPM_CONFIG_GLOBALCONFIG="$release_tmp/npm-globalconfig"
 /bin/bash "$root/scripts/verify-schema-v3-only.sh" --bootstrap-trust-only
 (cd "$root/backend" && npm ci --ignore-scripts)
 (cd "$root/backend" && npm run build)