[XELP] Depend on the published @plexinc packages

.github/workflows/build.yml

@@ -8,15 +8,25 @@ on:
 jobs:
   ci:
     runs-on: ${{ matrix.os }}
+    # npm ci reads @plexinc packages, so do not rely on the repository
+    # default, which an organization can tighten without warning.
+    permissions:
+      contents: read
+      packages: read
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
       - uses: actions/checkout@master
       - uses: actions/setup-node@master
         with:
-          node-version: "18.18.2"
-      - run: npm ci
+          node-version: "20.19.4"
+          registry-url: 'https://npm.pkg.github.com'
+          scope: '@plexinc'
+      - name: npm ci
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npm ci
       - run: npm run build
       - run: npm run lint
       - run: npm run test

.github/workflows/xelp_shadow_release.yml

@@ -8,6 +8,10 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      # The install pulls @plexinc packages, and an explicit permissions block
+      # sets everything it does not list to none.
+      #
+      packages: read
     steps:
       - name: Checkout xelp/main
         uses: actions/checkout@v4
@@ -19,6 +23,8 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '22.12.0'
+          registry-url: 'https://npm.pkg.github.com'
+          scope: '@plexinc'
 
       - name: Configure Git
         run: |
@@ -68,6 +74,8 @@ jobs:
           echo "tag_version=$TAG_VERSION" >> $GITHUB_OUTPUT
           echo "metadata_version=$METADATA_VERSION" >> $GITHUB_OUTPUT
       - name: Install dependencies
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: npm ci
 
       - name: Update package.json version

.npmrc

@@ -0,0 +1,3 @@
+# Use GitHub for @plexinc packages.
+@plexinc:registry=https://npm.pkg.github.com/
+//npm.pkg.github.com/:always-auth=true

package.json

@@ -56,8 +56,8 @@
         "@vscode/extension-telemetry": "^0.4.7",
         "array-sort": "^1.0.0",
         "backoff": "^2.5.0",
-        "brighterscript": "https://github.com/plexinc/brighterscript.git#0.70.202603123",
-        "brighterscript-formatter": "https://github.com/plexinc/brighterscript-formatter.git#1.7.2026031221",
+        "brighterscript": "npm:@plexinc/brighterscript@0.70.202608283",
+        "brighterscript-formatter": "npm:@plexinc/brighterscript-formatter@1.7.2026082821",
         "clone-deep": "^4.0.1",
         "debounce": "^1.2.0",
         "dotenv": "^6.2.0",