ops(sync): add .npmrc to the file-sync map

[laurenhitchon]

Turns on the half of Phase 2 that was never wired up.

What I found

.nvmrc was already mapped in every group — my earlier read that Phase 2 was untouched was wrong. All 22 repos report 24.16.0, which also resolves the doc's stale caveat about dtl-sandbox and nswds-tokens running Node 22.

.npmrc was the missing half. Current state across the 22 sync targets:

	count
engine-strict=true by hand	8
no .npmrc at all	12
bespoke variants	2 (nswds-ui, ictds-portal-flows)

Two carve-outs, not a blind sync

nswds-ui gets a variant source (repo-files/.npmrc-nswds-ui). Its .npmrc is provenance=false, not engine-strict — npm only supports provenance for public source repos and this one is private. A whole-file sync of the canonical would reintroduce the E422 publish failure that, per its own comment, silently stranded v1.8.0–v2.1.0 as git tags that never reached npm. The variant preserves that directive verbatim.

It deliberately does not add engine-strict there: nswds-ui is a Turborepo monorepo whose workspace packages each declare their own engines, so enabling it should be a considered pass rather than a side effect of this change.

ictds-portal-flows' rationale is promoted, not destroyed. It had a 12-line explanation of why engine-strict matters written into its own .npmrc. That reasoning now lives in the canonical, so the sync spreads it to all 21 repos instead of stripping it from the one that had it.

Is adding engine-strict to 12 repos safe?

Yes, verified rather than assumed — every repo's .nvmrc is 24.16.0, and that satisfies every declared engines.node across the fleet. Nothing that installed before stops installing.

It is load-bearing going forward: it converts an engines warning nobody reads into a failure in the install / install job that rulesets already require. Without it, an innocuous .nvmrc edit could pass CI and then run unsupported code on main mid-release.

Verification

• .github/sync.yml parses as valid YAML; 5 groups intact
• Mapping confirmed: 21 repos → repo-files/.npmrc, nswds-ui → repo-files/.npmrc-nswds-ui
• nswds-ui variant preserves provenance=false exactly (diffed against its current file)
• deleteOrphaned still absent (only the warning comment)
• Sync workflow already triggers on repo-files/**, so no workflow change needed

Blast radius

Merging fans out chore(ci): PRs to 22 repos. They are PRs, not direct pushes — SKIP_PR: false — so each is reviewable before it lands.

[DFSIdigital]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

This PR completes the previously unwired “Phase 2” of the fleet config convergence by adding .npmrc to the repo-file sync map, with an explicit carve-out for nswds-ui via a variant canonical file to preserve its private-publish constraints.

Changes:

• Add canonical repo-files/.npmrc enabling engine-strict=true (with rationale in-file).
• Add repo-files/.npmrc-nswds-ui variant preserving provenance=false and intentionally omitting engine-strict.
• Update .github/sync.yml to sync .npmrc into all groups (variant source for nswds-ui) and update the rollout documentation accordingly.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
repo-files/.npmrc-nswds-ui	Introduces the nswds-ui-specific .npmrc canonical variant to preserve provenance=false and avoid syncing engine-strict there.
repo-files/.npmrc	Adds the fleet-wide canonical .npmrc with engine-strict=true plus explanatory comments.
docs/config-single-source-of-truth.md	Updates the “single source of truth” doc to reflect .npmrc syncing (and the nswds-ui variant) and marks Phase 2 as completed.
.github/sync.yml	Wires .npmrc into the file-sync map across all repo groups, using the variant source for nswds-ui.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.