[expo-cli] EAS Build support experimental.npmToken in credentials.json

[wkozyra95]

[do not merge before turtle changes are deployed]

Why

Support for private packages

How

add experimental.npmToken field to credentials.json

[brentvatne]

something doesn't feel quite right about having credentials.json also contain arbitrary env vars. for comparison, both netlify and vercel provide two options for setting env vars:

1. set in config files (vercel.json / netlify.toml) - this is useful for env vars that are not secrets
2. set on backend via cli or web ui, eg: vercel env add [secret-name] [secret-value] - this is useful for values you don't want in source control

i think we should do something similar. we probably want to have env vars in eas.json associated with build profiles, and then run eas build:secrets:add [name] [value] to encrypt/save the value on our backend and then load that in the build server when running a related build job

---

one concrete workflow concern i have about using credentials.json in this way is that you can no longer just clone the project and run a build without having committed credentials.json to source control.

[brentvatne]

let's chat about this more before landing it

[brentvatne]

i was just discussing this with @ide and another thing we could do here so that we aren't committing to this particular api is to constrain it specifically to just setting the NPM_TOKEN environment variable and flag it as experimental. i think in the longer term we want some solution for env vars like this but we may not have time to build this at the moment. so instead, we could add something like this to credentials.json:

"experimental": {

  "npmToken": "..."

}