Frogbot PR scan does not work with yarn using private repo

Describe the bug

Frogbot seems to not pass token to yarn for private repo access when scanning pull requests. Here's the error:

Fetch step
  ➤ YN0041: │ @PRIVATE_ORG/PRIVATE_REPO@npm:1.1.3::__archiveUrl=https%3A%2F%2Fnpm.pkg.github.com%2Fdownload%2F%40PRIVATE_ORG%2FPRIVATE_REPO%2F1.1.3%2F097e2a3f34c9d1a8f4dce81ff234314d3a22dee5: Invalid authentication (as an anonymous user)

GitHub workflow used to launch frogbot PR scan:

name: Frogbot Scan for Pull Request
on:
  pull_request_target:
    types: [opened, synchronize]
permissions:
  pull-requests: write
  contents: read
jobs:
  invoke-frogbot-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Invoke Frogbot scan
        uses: jfrog/frogbot@v2
        env:
          JF_URL: 'https://PRIVATE_ARTIFACTORY/'
          JF_ACCESS_TOKEN: ${{ secrets.JFROG_TOKEN }}
          JF_GIT_TOKEN: ${{ secrets.GIT_TOKEN }}
          JF_WATCHES: 'ospo-licenses-unblocking-critical-high,es-core-cve-unblocking'
          JF_INCLUDE_ALL_VULNERABILITIES: 'FALSE'
          JF_FAIL: 'TRUE'

.yarnrc.yml content:

compressionLevel: mixed
enableGlobalCache: false
nodeLinker: node-modules
npmScopes:
    PRIVATE_ORG:
        npmAuthToken: ${NPM_TOKEN-}
        npmRegistryServer: 'https://npm.pkg.github.com'

yarnPath: .yarn/releases/yarn-4.6.0.cjs

.frogbot/frogbot-config.yml content:

- params:
      git:
          repoName: PRIVATE_GH_REPO
          branches:
              - main
      scan:
          projects:
              - installCommand: yarn install
                workingDirs:
                    - '.'

However, if I check out frogbot repo and build the tool locally and then execute with additional environment variables for owner and repo names, PR number, it works then. It looks as something is lost when frobgbot is run through the GitHub action. I've reproduced successful local run in GitHub workflow. It's strange, but this works:

name: Frogbot Scan for Pull Request
on:
  pull_request_target:
    types: [opened, synchronize]
permissions:
  pull-requests: write
  contents: read
jobs:
  invoke-frogbot-scan:
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.ref }}
      - name: yarn
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          yarn install
      - name: Invoke Frogbot scan
        env:
          JF_URL: 'https://PRIVATE_ARTIFACTORY/'
          JF_ACCESS_TOKEN: ${{ secrets.JFROG_TOKEN }}
          JF_GIT_TOKEN: ${{ secrets.GIT_TOKEN }}
          JF_WATCHES: 'ospo-licenses-unblocking-critical-high,es-core-cve-unblocking'
          JF_INCLUDE_ALL_VULNERABILITIES: 'FALSE'
          JF_FAIL: 'TRUE'
          JF_GIT_PROVIDER: 'github'
          JF_GIT_OWNER: 'PRIVATE_ORG'
          JF_GIT_REPO: 'PRIVATE_GH_REPO'
          JF_GIT_PULL_REQUEST_ID: ${{ github.event.pull_request.number }}
        run: |
          GWD=$(mktemp -d)
          cd ${GWD}
          git clone https://github.com/jfrog/frogbot.git
          cd frogbot
          ./buildscripts/build.sh
          ./frogbot scan-pull-request

The strangest part is that without checkout and yarn install steps it gets the same auth error as using frogbot action. Probably something is set/populated in GitHub runner with those steps. Also, if I do checkout and yarn install before using the GitHub action, it too gets the auth error.

And, of course, it is inefficient every time checking out and building the tool. I'd rather use the GitHub action.

Current behavior

Frogbot PR scan fails when yarn tries to fetch packages from private repo.

Reproduction steps

No response

Expected behavior

No response

JFrog Frogbot version

v2 of GitHub action

Package manager info

yarn

Git provider

GitHub

JFrog Frogbot configuration yaml file

No response

Operating system type and version

Ubuntu 24.04

JFrog Xray version

No response

Start by reviewing the v2 GitHub Action entry point and how it invokes frogbot scan-pull-request, then compare its environment handling with the locally built workflow. Check .yarnrc.yml, .frogbot/frogbot-config.yml, and buildscripts/build.sh; the issue is done when an action-based PR scan can fetch the private package without checkout and build steps.