Set npmToken value in npmrc string even when it is not withtin encrypted object

[RahulGautamSingh]

We moved from keeing secrets inside the encrypted object to using the Mend Developer portal for users of the Github App. But, missed to make some necessary modififcations to the logic which would use the npmToken value from the config and replace ${NPM_TOKEN} in the npmrc string with it.

For example:

{
  "npmToken": "{{ secrets.NPM_TOKEN }}",
  "npmrc": "@fortawesome:registry=https://npm.fontawesome.com\n//npm.fontawesome.com/:_authToken=${NPM_TOKEN}"
}

Expected behaviour for the above config is that npmToken value is add to the npmrc string.

But, actually the npmToken value is not added to the npmrc string. And, this causes lookup errors down the line.

Example of such cases: #31707 #31253

Reason for this:

• decryptConfig fn handles the logic to replace ${NPM_TOKEN} in the npmrc string with value of npmToken.
• decryptConfig only processes items in the encrypted object.
• Since npmToken does not necessarily have to be in the encrypted object anymore, this logic fails for Github App users.

Fix:
Reuse the logic in decryptConfig and place it such that the value from npmToken replaces the ${NPM_TOKEN}. Most probably, this logic goes after the secrets have been applied to the config ie. at the end of mergeRenovateConfig fn

Originally posted by @RahulGautamSingh in #31707 (reply in thread)