BUILD-9995 add working-directory input to build-yarn

[julien-carsique-sonarsource]

BUILD-9995 add working-directory input to build-yarn

Fix attestation artifacts path when working-directory is set: use absolute paths instead of relative.
Fix Yarn authentication

Tested with

• https://github.com/SonarSource/sonar-dummy-yarn/pull/35

[hashicorp-vault-sonar-prod]

BUILD-9995

[sonarqubecloud]

SonarQube reviewer guide

Important

We are currently testing different models for AI Summary.
Please give us your feedback by filling this form.

Model A:

Summary: Add working-directory input to support building Yarn projects in subdirectories.

Review Focus:

• Configuration file generation changes from npm config set to direct .npmrc and .yarnrc.yml file creation
• Working directory propagation through all action steps and script execution
• Absolute path handling in export_built_artifacts function

Start review at: build-yarn/build.sh. The NPM/Yarn configuration approach has been fundamentally changed from CLI commands to direct config file generation, which is the most critical and risky change in this PR.

Model B:

Summary: Add working-directory input to support executing builds in subdirectories, and refactor npm/yarn configuration management to use config files instead of CLI commands.

Review Focus:

• The npm/yarn configuration refactoring in build.sh (lines 93-107) changes from CLI-based config to file-based .npmrc and .yarnrc.yml. Verify the config format is correct and authentication tokens are properly handled.
• Ensure the working-directory input is correctly propagated through all build steps (mise-action, build.sh execution).
• The artifact path fix using $PWD in export_built_artifacts() - confirm this works correctly with the new working-directory feature.

Start review at: build-yarn/action.yml. This is the entry point where the new input is defined and passed to downstream steps. Understanding how working-directory flows through the action is critical before reviewing the shell script changes.

Quality Gate passed

Issues
0 New issues
2 Accepted issues
0 Dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud