private npm GitHub Actions

Install private npm packages in GitHub Actions

A CI setup for installing private npm packages from a scoped registry without checking secrets into the repository.

Build config Start free

Implementation checklist

Store the install token as a GitHub Actions secret.

Write .npmrc during the workflow or commit a token-free .npmrc template.

Scope the token to install access, not publishing access.

Run npm ci after the registry and token are configured.

Step 1

Use a secret-backed .npmrc

Write the scoped registry line and token line before dependency install. The workflow can keep the package manager command normal after that.

.github/workflows/test.yml

steps:
  - uses: actions/checkout@v4
  - uses: actions/setup-node@v4
    with:
      node-version: 22
  - run: |
      echo "@acme:registry=https://registry.packagepass.dev/npm/" >> .npmrc
      echo "//registry.packagepass.dev/npm/:_authToken=${PACKAGEPASS_INSTALL_TOKEN}" >> .npmrc
      echo "always-auth=true" >> .npmrc
    env:
      PACKAGEPASS_INSTALL_TOKEN: ${{ secrets.PACKAGEPASS_INSTALL_TOKEN }}
  - run: npm ci

Step 2

Do not reuse a publish token for installs

CI jobs that only install dependencies should not hold publish access. PackagePass supports install-only CI tokens so a compromised test job cannot publish a replacement package.

PackagePass keeps install access, tokens, and audit events tied to the package workflow.

Step 3

Map access to the workflow

Some jobs need preview packages, some need stable packages, and some should not install private packages at all. Treat CI as a subject in the access model.

PackagePass keeps install access, tokens, and audit events tied to the package workflow.

FAQ

Can I commit .npmrc?

Yes, if it only contains registry configuration and environment-variable placeholders. Do not commit actual token values.

Does this work with pnpm?

Yes. Configure the registry before running pnpm install and keep the token in the workflow secret store.

Next step

Turn the config into controlled package access.

PackagePass adds customer, project, user, and CI grants on top of normal npm-compatible installs.

Create a package Private registry