feat: Private Hex packages

[kamilkowalski]

Changes:

Introduced support for private Hex packages as discussed in #11028.

Example PR opened with private package support: kamilkowalski/public_project#11.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please tick one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[viceice]

manager needs coverage fix

[viceice]

We should also try to move the linked issue forward. So hexpm support standard bearer auth in near future. This shouldn't be hard for an elexir developer.

[viceice]

Some small test changes and then we are ready to go

[HonkingGoose]

Docs look fine.

I see a lot of CodeQL warnings though... Are we sure this is good to go?

[kamilkowalski]

@HonkingGoose it started flagging dummy authorization headers used in tests once I moved them from inline snapshots, or when assertions were added. Looking at the HardcodedCredentials check it doesn't flag these if the credentials look like dummy ones - and the definition of a dummy credential can be found in SensitiveActions.qll.

I can probably replace all tokens used in tests with "secret" which shouldn't raise issues, but I don't know what to do about auth.ts:40 (which I didn't even change)- I don't think there's anything to fix there. What's your policy around CodeQL - ignore the line, merge without all checks passing?

[HonkingGoose]

Maybe there was some problem in the main branch when you started working? You could try merging in the current main branch and see if that reduces the warnings.

I don't know enough about the code to say anything meaningful about getting rid of the CodeQL warnings, and I also don't know anything about our CodeQL warning policy. 😉

I'll let @viceice or @rarkins help you with the warnings. 😉

[rarkins]

I've manually dismissed the codeql errors. 4 were used in tests, and 1 was a false positive

[renovate-release]

🎉 This PR is included in version 25.72.0 🎉

The release is available on:

• GitHub release
• 25.72.0

Your semantic-release bot 📦🚀