Dataform uses trusted registry for CI builds. It does that by relying on nodejs's npm install interaction with yarn.lock. This interaction is known to be error-prone (for ex. npm/cli#5126), yarn recommends to only use yarn CLI when working with it's ecosystem. In particular, it blocks update of the Node, forcing us to use the version that is long out of EOL support (v16). Newer version breaks yarn.lock on npm install. Apart from that we don't verify that yarn.lock updates only registry.

Addressing that by reimplementing registry substitution explicitly and switching to yarn install --freeze-lockfile instead of npm install. This will ensure that:

We only change the registry, all other parts of the lock file like versions or hashsums remain the same.
We don't change resolved versions by accident if there is a conflict between package.json spec and lockfile.
Long-term solution would be migration to a supported NodeJS rules (most likely Aspect's), where we would be able to leverage PNPM, whose lockfile doesn't fix registry URL at all - only versions and hashsums.