ci: start Nexus in CI to serve patched npm packages

- Add .github/actions/setup-npm composite action:
  Starts Nexus, waits for health, inits npm repos, publishes patches, npm install
  Caches /tmp/nexus-data between runs for fast restarts
- Add deployment/nexus-ci-init.sh: lightweight Nexus init for CI (npm repos only)
- Replace all 9 manual Setup Node + npm install steps in gated-pipeline.yml
  with the composite action
- Re-enable @esbuild-kit:registry in .npmrc (Nexus now always available)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/actions/setup-npm/action.yml

@@ -0,0 +1,62 @@
+name: 'Setup npm with Nexus'
+description: 'Starts Nexus, publishes patched packages, then runs npm install'
+
+inputs:
+  node-version:
+    description: 'Node.js version'
+    required: false
+    default: '20'
+
+runs:
+  using: composite
+  steps:
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ inputs.node-version }}
+
+    - name: Cache Nexus data
+      uses: actions/cache@v4
+      with:
+        path: /tmp/nexus-data
+        key: nexus-data-v1-${{ hashFiles('deployment/npm-patches/**', 'deployment/nexus-init.sh') }}
+        restore-keys: |
+          nexus-data-v1-
+
+    - name: Start Nexus
+      shell: bash
+      run: |
+        docker run -d --name nexus \
+          -p 8091:8081 \
+          -v /tmp/nexus-data:/nexus-data \
+          --platform linux/amd64 \
+          sonatype/nexus3:3.75.0
+        echo "Nexus starting..."
+
+    - name: Wait for Nexus
+      shell: bash
+      run: |
+        echo "Waiting for Nexus to be healthy (up to 3 minutes)..."
+        timeout 180 bash -c '
+          until curl -sf http://localhost:8091/service/rest/v1/status -u admin:nexus >/dev/null 2>&1 || \
+                curl -sf http://localhost:8091/service/rest/v1/status >/dev/null 2>&1; do
+            echo "  still waiting..."
+            sleep 10
+          done
+        '
+        echo "Nexus is up"
+
+    - name: Initialise Nexus (npm repos)
+      shell: bash
+      env:
+        NEXUS_URL: http://localhost:8091
+        NEXUS_ADMIN_NEW_PASS: nexus
+      run: bash deployment/nexus-ci-init.sh
+
+    - name: Publish patched npm packages
+      shell: bash
+      run: bash deployment/publish-npm-patches.sh
+
+    - name: Install npm dependencies
+      shell: bash
+      run: npm install

.github/workflows/gated-pipeline.yml

@@ -398,13 +398,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Setup npm with Nexus
+        uses: ./.github/actions/setup-npm
         with:
-          node-version: 20
-
-      - name: Install dependencies
-        run: npm install
+          node-version: '20'
 
       - name: Build workspace packages
         run: npm run build --workspaces --if-present 2>&1 || true
@@ -435,13 +432,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Setup npm with Nexus
+        uses: ./.github/actions/setup-npm
         with:
-          node-version: 20
-
-      - name: Install dependencies
-        run: npm install
+          node-version: '20'
 
       - name: Build workspace packages
         run: npm run build --workspaces --if-present 2>&1 || true
@@ -483,13 +477,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Setup npm with Nexus
+        uses: ./.github/actions/setup-npm
         with:
-          node-version: 20
-
-      - name: Install dependencies
-        run: npm install
+          node-version: '20'
 
       - name: Run dependency audit
         run: |
@@ -696,13 +687,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Setup npm with Nexus
+        uses: ./.github/actions/setup-npm
         with:
-          node-version: 20
-
-      - name: Install dependencies
-        run: npm install
+          node-version: '20'
 
       - name: Run unit tests with coverage
         run: |
@@ -769,13 +757,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Setup npm with Nexus
+        uses: ./.github/actions/setup-npm
         with:
-          node-version: 20
-
-      - name: Install dependencies
-        run: npm install
+          node-version: '20'
 
       - name: Install Playwright Browsers
         run: npx playwright install --with-deps chromium
@@ -819,13 +804,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Setup npm with Nexus
+        uses: ./.github/actions/setup-npm
         with:
-          node-version: 20
-
-      - name: Install dependencies
-        run: npm install
+          node-version: '20'
 
       - name: Install Playwright Browsers
         run: npx playwright install --with-deps chromium
@@ -932,13 +914,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Setup npm with Nexus
+        uses: ./.github/actions/setup-npm
         with:
-          node-version: 20
-
-      - name: Install dependencies
-        run: npm install
+          node-version: '20'
 
       - name: Build workspace packages
         run: npm run build --workspaces --if-present 2>&1 || true
@@ -1226,13 +1205,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Setup npm with Nexus
+        uses: ./.github/actions/setup-npm
         with:
-          node-version: 20
-
-      - name: Install dependencies
-        run: npm install
+          node-version: '20'
 
       - name: Build for staging
         run: npm run build -w frontends/nextjs
@@ -1279,13 +1255,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Setup npm with Nexus
+        uses: ./.github/actions/setup-npm
         with:
-          node-version: 20
-
-      - name: Install dependencies
-        run: npm install
+          node-version: '20'
 
       - name: Build for production
         run: npm run build -w frontends/nextjs