Automatically configure NPM_CONFIG_GLOBALCONFIG with location of a binding of type npmrc

[ryanmoran]

Summary

It is not uncommon to want to include secrets in npm configuration. In some cases these secrets cannot be passed via environment variables as they are not stored securely on the platform that is executing the build. Instead, we tell developers that they can use a binding and then specify NPM_CONFIG_GLOBALCONFIG to point to that binding location.

The buildpack could handle this wiring automatically. If a binding is of type npmrc, then it can assign NPM_CONFIG_GLOBALCONFIG to point to that binding location automatically, thus saving developers from having to hardcode this into their build configurations.

[noamichael]

This is critical for when npm install needs to reach out to private artifact repositories that require credentials, such as Artifactory. The registry auth tokens are stored in the .npmrc file and should not be committed to the source code repository, so a binding would be required.

[fg-j]

Has this issue been completed? It seems like the npm-install and yarn-install buildpacks now set this env var.