[worker][build-tools] Route npm installs through internal registry cache proxy

CHANGELOG.md

@@ -12,6 +12,8 @@ This is the log of notable changes to EAS CLI and related packages.
 
 ### 🧹 Chores
 
+## [19.0.7](https://github.com/expo/eas-cli/releases/tag/v19.0.7) - 2026-05-21
+
 ## [19.0.6](https://github.com/expo/eas-cli/releases/tag/v19.0.6) - 2026-05-21
 
 ### 🐛 Bug fixes

packages/build-tools/src/common/installDependencies.ts

@@ -51,6 +51,10 @@ export async function installDependenciesAsync({
           '--production',
           'false',
         ];
+        // Yarn Classic doesn't respect NPM_CONFIG_REGISTRY, so pass --registry flag
+        if (env['EAS_BUILD_NPM_CACHE_URL']) {
+          args.push('--registry', env['EAS_BUILD_NPM_CACHE_URL']);
+        }
       }
       break;
     }

packages/build-tools/src/templates/npmrc.ts

@@ -1,3 +1,2 @@
 export const NpmrcTemplate = `//registry.npmjs.org/:_authToken=\${NPM_TOKEN}
-registry=https://registry.npmjs.org/
 `;

packages/worker/src/env.ts

@@ -41,6 +41,10 @@ export function getBuildEnv({
   setEnv(env, 'NPM_CACHE_URL', config.npmCacheUrl);
   setEnv(env, 'NVM_NODEJS_ORG_MIRROR', config.nodeJsCacheUrl);
   setEnv(env, 'EAS_BUILD_NPM_CACHE_URL', config.npmCacheUrl);
+  // Force npm/pnpm/bun to use cache registry (overrides .npmrc files)
+  setEnv(env, 'NPM_CONFIG_REGISTRY', config.npmCacheUrl);
+  // Force Yarn Berry to use cache registry (overrides .yarnrc.yml files)
+  setEnv(env, 'YARN_NPM_REGISTRY_SERVER', config.npmCacheUrl);
   setEnv(env, 'EAS_BUILD_PROFILE', metadata.buildProfile);
   setEnv(env, 'EAS_BUILD_GIT_COMMIT_HASH', metadata.gitCommitHash);
   setEnv(env, 'EAS_BUILD_ID', buildId);