Electron and electron-builder binaries bypass the npm proxy

[BernardJen]

Part of the JFrog PoC. This is a finding as much as a task: the npm proxy does not cover this project's whole supply chain.

The problem

package.json has "postinstall": "electron-builder install-app-deps", and electron's own postinstall downloads the ~100 MB runtime zip from GitHub Releases, not npm. electron-builder likewise fetches its helper binaries (app-builder, winCodeSign, NSIS) from GitHub. None of that traffic goes through npm-dev.

So "all our dependencies come from JFrog" is false for SlideCue out of the box, and a GitHub outage is still a release outage.

What to do

Add a generic remote repository in Artifactory proxying https://github.com releases, then point the mirrors at it:

export ELECTRON_MIRROR="$JF_URL/artifactory/github-remote/electron/electron/releases/download/v"
export ELECTRON_BUILDER_BINARIES_MIRROR="$JF_URL/artifactory/github-remote/electron-userland/electron-builder-binaries/releases/download/"

Set them in the release workflow rather than committing them, for the same public-clone reason as #53.

Done when

• A full npm run dist:mac completes with GitHub Releases unreachable and Artifactory reachable
• The measured effort and any surprises are logged in Lab271/labs-jfrog-poc NOTES.md
• If this turns out not to be practical, that is recorded as a genuine limit of the npm pilot rather than quietly dropped