lukaszraczylo/shared-actions
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/shared-actions.git synced 2026-10-15 05:29:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(npm): support a private registry token

Browse Source
This commit is contained in:
lukaszraczylo
2026-10-03 22:44:30 +01:00
parent 2e49670452
commit caaad0efab
3 changed files with 80 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+8
View File
@@ -122,10 +122,14 @@ jobs:
| `pnpm-version` | | pnpm version for a repo with no `packageManager` field. Empty uses the field, or the newest pnpm. |
| `require-tests` | `false` | Fail when there is no `test` script |
| `lfs` | `false` | Git LFS checkout |
| `npm-registry-scope` | | Scope served by a private npm registry, for example `@fortawesome`. |
| `npm-registry-url` | | URL of that registry, for example `https://npm.fontawesome.com/`. |
| `runner` | | Runner label or runner group, as in the other workflows |
pnpm is used when `pnpm-lock.yaml` exists, yarn for `yarn.lock`, otherwise npm. pnpm and yarn run through Corepack, so set `packageManager` in `package.json`.
**Private npm registry.** Set `npm-registry-scope`, `npm-registry-url` and the `npm-registry-token` secret together; with any one missing nothing changes. The token goes into an npmrc outside the checkout (`NPM_CONFIG_USERCONFIG`), is masked in logs, and works for npm, pnpm and yarn classic. Yarn 2+ ignores npmrc and needs its own `.yarnrc.yml`.
### `go-autoupdate.yaml`
Automatic dependency updates for Go. See `renovate-autoupdate.yaml` for the Renovate-based replacement that also covers npm, pnpm and yarn.
@@ -194,8 +198,12 @@ The workflow finds `go.mod` and `package.json` itself and tests what exists. A r
| `release-workflow` | | Workflow file to dispatch after a merge, for example `release.yaml`. Give several as a comma-separated list. Each needs a `workflow_dispatch` trigger. Empty means no dispatch. |
| `admin-merge` | `false` | Merge with `--admin`. The workflow token cannot bypass branch protection. |
| `lfs` | `false` | Git LFS checkout |
| `npm-registry-scope` | | Scope served by a private npm registry, for example `@fortawesome`. |
| `npm-registry-url` | | URL of that registry, for example `https://npm.fontawesome.com/`. |
| `runner` | | Runner label or runner group, as in the other workflows |
**Private npm registry.** Set `npm-registry-scope`, `npm-registry-url` and the `npm-registry-token` secret together; with any one missing nothing changes. Renovate and the install step both use it. The token goes into an npmrc outside the checkout (`NPM_CONFIG_USERCONFIG`), is masked in logs, and works for npm, pnpm and yarn classic. Yarn 2+ ignores npmrc and needs its own `.yarnrc.yml`.
**Failing updates.** The last 50 KB of the test output goes into a comment on one issue titled "Dependency updates failing tests". Each failing branch has its own comment, updated on every run, and a header with the commit and the run link. When a branch passes and merges, its comment is removed. When no failing branch is left, the issue closes. The output is also in the run summary. Without `issues: write` the run still works, but the issue is skipped.
**Only what is tested is updated.** Renovate manages one Go module and one Node project: the ones in `go-working-directory` and `node-working-directory`. A second `package.json` (docs, e2e tests, another frontend) or a second `go.mod` is left alone, because nothing would test its updates.