Anyone with write permissions for a repository can publish a package to that repository.
You can help people understand and use your package by providing a description and other details like installation and usage instructions on the package page. GitHub provides metadata for each version, such as the publication date, download activity, and recent versions. For an example package page, see @Codertocat/hello-world-npm.
You can publish packages in a public repository (public packages) to share with all of GitHub, or in a private repository (private packages) to share with collaborators or an organization. A repository can contain more than one package. To prevent confusion, make sure the README and description clearly provide information about each package.
To prevent confusion and build problems, GitHub permanently reserves a package's name and version number. Even if an entire package is deleted, you cannot reuse the deleted package name in any repository owned by the same account.
To revise or replace a package version, we recommend you publish a new version of your package.
If a new version of a package fixes a security vulnerability, you should publish a security advisory in your repository. GitHub reviews each published security advisory and may use it to send Dependabot alerts to affected repositories. For more information, see "About GitHub Security Advisories."
You can publish a package to GitHub Packages using any supported package client by following the same general guidelines.
- Create or use an existing access token with the appropriate scopes for the task you want to accomplish. For more information, see "About GitHub Packages."
- Authenticate to GitHub Packages using your access token and the instructions for your package client.
- Publish the package using the instructions for your package client.
For instructions specific to your package client, see "Using GitHub Packages with your project's ecosystem."
After you publish a package, you can view the package on GitHub. For more information, see “Viewing packages.”