Skip to main content

Working with the npm registry

You can configure npm to publish packages to GitHub Packages and to use packages stored on GitHub Packages as dependencies in an npm project.

GitHub Packages está disponible con GitHub Free, GitHub Pro, GitHub Free para organizaciones, GitHub Team, GitHub Enterprise Cloud, GitHub Enterprise Server 3.0 o superior y GitHub AE.
GitHub Packages no está disponible para repositorios privados que pertenezcan a cuentas que utilicen planes tradicionales por repositorio. Las cuentas que utilicen los planes tradicionales por repositorio tampoco podrán acceder al Container registry ya que estas cuentas se facturan por repositorio. Para más información, vea "Productos de GitHub".

Authenticating to GitHub Packages

GitHub Packages solo admite la autenticación mediante un personal access token (classic). Para obtener más información, consulta "Creación de un personal access token".

You need an access token to publish, install, and delete private, internal, and public packages.

You can use a personal access token (classic) to authenticate to GitHub Packages or the GitHub API. When you create a personal access token (classic), you can assign the token different scopes depending on your needs. For more information about packages-related scopes for a personal access token (classic), see "About permissions for GitHub Packages."

To authenticate to a GitHub Packages registry within a GitHub Actions workflow, you can use:

  • GITHUB_TOKEN to publish packages associated with the workflow repository.
  • a personal access token (classic) with at least packages:read scope to install packages associated with other private repositories (which GITHUB_TOKEN can't access).

Si en el flujo de trabajo se usa un personal access token para autenticarse en un registro, se recomienda encarecidamente actualizar el flujo de trabajo para usar el GITHUB_TOKEN.

Para instrucciones sobre cómo actualizar los flujos de trabajo que se autentican en un registro con un personal access token, consulta "Actualización de un flujo de trabajo que accede a un registro mediante un personal access token".

Para más información sobre GITHUB_TOKEN, vea "Autenticación en un flujo de trabajo".

Para obtener más información sobre los procedimientos recomendados al usar un registro en acciones, consulta "Fortalecimiento de seguridad para Acciones de GitHub".

You can also choose to give access permissions to packages independently for Codespaces and GitHub Actions. For more information, see "Ensuring Codespaces access to your package and Ensuring workflow access to your package."

Authenticating with a personal access token

You must use a personal access token (classic) with the appropriate scopes to publish and install packages in GitHub Packages. For more information, see "About GitHub Packages."

You can authenticate to GitHub Packages with npm by either editing your per-user ~/.npmrc file to include your personal access token (classic) or by logging in to npm on the command line using your username and personal access token.

To authenticate by adding your personal access token (classic) to your ~/.npmrc file, edit the ~/.npmrc file for your project to include the following line, replacing TOKEN with your personal access token. Create a new ~/.npmrc file if one doesn't exist.

//npm.pkg.github.com/:_authToken=TOKEN

To authenticate by logging in to npm, use the npm login command, replacing USERNAME with your GitHub username, TOKEN with your personal access token (classic), and PUBLIC-EMAIL-ADDRESS with your email address.

If GitHub Packages is not your default package registry for using npm and you want to use the npm audit command, we recommend you use the --scope flag with the owner of the package when you authenticate to GitHub Packages.

$ npm login --scope=@OWNER --registry=https://npm.pkg.github.com

> Username: USERNAME
> Password: TOKEN
> Email: PUBLIC-EMAIL-ADDRESS

Publishing a package

Note: Package names and scopes must only use lowercase letters.

The GitHub Packages registry stores npm packages within your organization or personal account, and allows you to associate a package with a repository. You can choose whether to inherit permissions from a repository, or set granular permissions independently of a repository.

By default, GitHub Packages publishes a package in the GitHub repository you specify in the name field of the package.json file. For example, you would publish a package named @my-org/test to the my-org/test GitHub repository. If you're running npm v8.5.3 or later, you can add a summary for the package listing page by including a README.md file in your package directory. For more information, see "Working with package.json" and "How to create Node.js Modules" in the npm documentation.

You can publish multiple packages to the same GitHub repository by including a URL field in the package.json file. For more information, see "Publishing multiple packages to the same repository."

When a package is published, it isn't automatically linked to a repository. You can however choose to link your published package to a repository using the user interface or command line. For more information, see "Connecting a repository to a package."

You can set up the scope mapping for your project using either a local .npmrc file in the project or using the publishConfig option in the package.json. GitHub Packages only supports scoped npm packages. Scoped packages have names with the format of @owner/name. Scoped packages always begin with an @ symbol. You may need to update the name in your package.json to use the scoped name. For example, "name": "@codertocat/hello-world-npm".

When you first publish a package, the default visibility is private. When a package is linked to repository, the package visibility is dependent on the repository's visibility. To change the visibility or set access permissions, see "Configuring a package's access control and visibility."

Después de que publiques un paquete, puedes verlo en GitHub. Para más información, vea "Visualización de paquetes".

Publishing a package using a local .npmrc file

You can use an .npmrc file to configure the scope mapping for your project. In the .npmrc file, use the GitHub Packages URL and account owner so GitHub Packages knows where to route package requests. Using an .npmrc file prevents other developers from accidentally publishing the package to npmjs.org instead of GitHub Packages.

  1. Autentícate en GitHub Packages. Para obtener más información, vea "Autenticación en GitHub Packages".

  2. En el mismo directorio que el archivo package.json, crea o edita un archivo .npmrc para incluir una línea que especifique la URL de GitHub Packages y el propietario de la cuenta. Reemplaza OWNER con el nombre de la cuenta de usuario o de organización a la que pertenece el repositorio que contiene el proyecto.

    @OWNER:registry=https://npm.pkg.github.com
  3. Agregue el archivo .npmrc al repositorio donde GitHub Packages pueda encontrar el proyecto. Para más información, vea "Adición de un archivo a un repositorio".

  4. Verify the name of your package in your project's package.json. The name field must contain the scope and the name of the package. For example, if your package is called "test", and you are publishing to the "My-org" GitHub organization, the name field in your package.json should be @my-org/test.

  5. Compruebe el campo repository en el archivo package.json del proyecto. El campo repository debe coincidir con la URL del repositorio GitHub. Por ejemplo, si la URL del repositorio es github.com/my-org/test, el campo del repositorio debe ser https://github.com/my-org/test.git.

  6. Publique el paquete:

    $ npm publish

Publishing a package using publishConfig in the package.json file

You can use publishConfig element in the package.json file to specify the registry where you want the package published. For more information, see "publishConfig" in the npm documentation.

  1. Edit the package.json file for your package and include a publishConfig entry.

    "publishConfig": {
      "registry": "https://npm.pkg.github.com"
    },
  2. Compruebe el campo repository en el archivo package.json del proyecto. El campo repository debe coincidir con la URL del repositorio GitHub. Por ejemplo, si la URL del repositorio es github.com/my-org/test, el campo del repositorio debe ser https://github.com/my-org/test.git.

  3. Publique el paquete:

    $ npm publish

Publishing multiple packages to the same repository

To publish multiple packages to the same repository, you can include the URL of the GitHub repository in the repository field of the package.json file for each package.

To ensure the repository's URL is correct, replace REPOSITORY with the name of the repository containing the package you want to publish, and OWNER with the name of the user or organization account on GitHub that owns the repository.

GitHub Packages will match the repository based on the URL, instead of based on the package name.

"repository":"https://github.com/OWNER/REPOSITORY",

Installing a package

You can install packages from GitHub Packages by adding the packages as dependencies in the package.json file for your project. For more information on using a package.json in your project, see "Working with package.json" in the npm documentation.

By default, you can add packages from one organization. For more information, see "Installing packages from other organizations."

You also need to add the .npmrc file to your project so that all requests to install packages will go through GitHub Packages. When you route all package requests through GitHub Packages, you can use both scoped and unscoped packages from npmjs.org. For more information, see "npm-scope" in the npm documentation.

  1. Autentícate en GitHub Packages. Para obtener más información, vea "Autenticación en GitHub Packages".

  2. En el mismo directorio que el archivo package.json, crea o edita un archivo .npmrc para incluir una línea que especifique la URL de GitHub Packages y el propietario de la cuenta. Reemplaza OWNER con el nombre de la cuenta de usuario o de organización a la que pertenece el repositorio que contiene el proyecto.

    @OWNER:registry=https://npm.pkg.github.com
  3. Agregue el archivo .npmrc al repositorio donde GitHub Packages pueda encontrar el proyecto. Para más información, vea "Adición de un archivo a un repositorio".

  4. Configure package.json in your project to use the package you are installing. To add your package dependencies to the package.json file for GitHub Packages, specify the full-scoped package name, such as @my-org/server. For packages from npmjs.com, specify the full name, such as @babel/core or @lodash. Replace <organization_name>/<package_name> with your package dependency.

    {
      "name": "@my-org/server",
      "version": "1.0.0",
      "description": "Server app that uses the <organization_name>/<package_name> package",
      "main": "index.js",
      "author": "",
      "license": "MIT",
      "dependencies": {
        "<organization_name>/<package_name>": "1.0.0"
      }
    }
    
  5. Install the package.

    $ npm install

Installing packages from other organizations

By default, you can only use GitHub Packages packages from one organization. If you'd like to route package requests to multiple organizations and users, you can add additional lines to your .npmrc file, replacing OWNER with the name of the user or organization account that owns the repository containing your project.

@OWNER:registry=https://npm.pkg.github.com
@OWNER:registry=https://npm.pkg.github.com