@cryptotaxi247 / documentation-1
Code Commits Issues Pulls Sessions CI/CD
@reggi/path-to-regexp
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 95 lines 3.73 KB
Raw
1 ---
2 title: Using private packages in a CI/CD workflow
3 redirect_from:
4 - /private-modules/ci-server-config
5 ---
6
7 You can use access tokens to test private npm packages with continuous integration (CI) systems, or deploy them using continuous deployment (CD) systems.
8
9 ## Create a new access token
10
11 Create a new access token that will be used only to access npm packages from a CI/CD server.
12
13 ### Continuous integration
14
15 When generating an access token for use in a continuous integration environment, we recommend using a granular access token with limited access to provide greater security.
16
17 If you use a legacy token instead, by default, `npm token create` will generate a token with both read and write permissions. We recommend creating a read-only token:
18
19 ```
20 npm token create --read-only
21 ```
22
23 For more information on creating access tokens, including CIDR-whitelisted tokens, see "[Creating an access token][create-token]".
24
25 ### Continuous deployment
26
27 Since continuous deployment environments usually involve the creation of a deploy artifact, you may wish to create an [automation token][create-token] on the website. This will allow you to publish even if you have two-factor authentication enabled on your account.
28
29 ### Interactive workflows
30
31 If your workflow produces a package, but you publish it manually after validation, then you will want to create a token with read and write permissions, which are granted with the standard token creation command:
32
33 ```
34 npm token create
35 ```
36
37 ### CIDR whitelists
38
39 For increased security, you may use a CIDR-whitelisted token that can only be used from a certain IP address range. You can use a CIDR whitelist with a read and publish token or a read-only token:
40
41 ```
42 npm token create --cidr=[list]
43 npm token create --read-only --cidr=[list]
44 ```
45
46 Example:
47
48 ```
49 npm token create --cidr=192.0.2.0/24
50 ```
51
52 For more information, see "[Creating and viewing authentication tokens][create-token]".
53
54 ## Set the token as an environment variable on the CI/CD server
55
56 Set your token as an environment variable, or a secret, in your CI/CD server.
57
58 For example, in GitHub Actions, you would [add your token as a secret](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets). Then you can make the secret available to workflows.
59
60 If you named the secret `NPM_TOKEN`, then you would want to create an environment variable named `NPM_TOKEN` from that secret.
61
62 ```
63 steps:
64 - run: |
65 npm install
66 - env:
67 NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
68 ```
69
70 Consult your CI/CD server's documentation for more details.
71
72 ## Create and check in a project-specific .npmrc file
73
74 Use a project-specific `.npmrc` file with a variable for your token to securely authenticate your CI/CD server with npm.
75
76 1. In the root directory of your project, create a custom `.npmrc` file with the following contents:
77
78 ```
79 //registry.npmjs.org/:_authToken=${NPM_TOKEN}
80 ```
81
82 **Note:** that you are specifying a literal value of `${NPM_TOKEN}`. The npm cli will replace this value with the contents of the `NPM_TOKEN` environment variable. Do **not** put a token in this file.
83
84 2. Check in the `.npmrc` file.
85
86 ## Securing your token
87
88 Your token may have permission to read private packages, publish new packages on your behalf, or change user or package settings. Protect your token.
89
90 Do not add your token to version control or store it insecurely. Store it in a password manager, your cloud provider's secure storage, or your CI/CD provider's secure storage.
91
92 When possible, use granular access tokens with the minimum permissions necessary, and set short expiration dates for your tokens. For more information, see "[About access tokens][about-tokens]."
93
94 [create-token]: creating-and-viewing-access-tokens
95 [about-tokens]: about-access-tokens