FrontEnd Pipelines: Using private NPM Repositories.

Adobe has documentation about how we would use Pipeline secrets and ENV variables to use a Private Maven Repository.

Is there something similar for the FrontEnd Sites projects and NPM??

e.g, if in my package.json I had this..

"dependencies": {
"my-private-repo": "git+https://${GITHUB_PAT_KEY}@github.com/My-Organization/Private-REPO.git"
}

I have been sandboxing this, and found that:

• Simply having GITHUB_PAT_KEY as a Pipeline secret does not work, as NPM is not picking up on the ENV variable.
• We cannot have exposed PAT keys in the codebase, and so the PAT must always be an ENV secret somewhere.
• I have tried using a npm preinstall which would insert the PAT key from process.env, but the pipeline is not able to run npm preinstall.
• Using git submodules or similar may have problems due to the predefined npm commands that the pipeline is using..

In short, how do we use a private repo as a dependancy for our Sites theme where it would build using the pipeline?