Skip to content

Replace GH_NPM_PACKAGE_READ_TOKEN with GITHUB_TOKEN - #308

Open
ntotten wants to merge 2 commits into
mainfrom
remove-gh-npm-package-read-token
Open

Replace GH_NPM_PACKAGE_READ_TOKEN with GITHUB_TOKEN#308
ntotten wants to merge 2 commits into
mainfrom
remove-gh-npm-package-read-token

Conversation

@ntotten

@ntotten ntotten commented Apr 14, 2026

Copy link
Copy Markdown
Member

Summary

  • Replaces GH_NPM_PACKAGE_READ_TOKEN PAT with native GITHUB_TOKEN for npm package access
  • Private @zuplo/* packages now grant Actions access to consuming repos directly via GitHub's package permissions

Changes

  • Workflow files: ${{ secrets.GH_NPM_PACKAGE_READ_TOKEN }}${{ github.token }}
  • Dependabot files: ${{ secrets.GH_NPM_PACKAGE_READ_TOKEN }}${{ secrets.GITHUB_TOKEN }}

Test plan

  • CI passes with the new token configuration
  • Private @zuplo/* packages install successfully

🤖 Generated with Claude Code

Use GitHub's native package access grants instead of a shared PAT
for installing private @zuplo npm packages.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings April 14, 2026 22:17
@vercel

vercel Bot commented Apr 14, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
rate-my-openapi Ready Ready Preview, Comment Apr 15, 2026 0:28am

Request Review

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR replaces the custom GH_NPM_PACKAGE_READ_TOKEN PAT usage with the built-in GitHub token mechanism for accessing private npm packages hosted in GitHub Packages.

Changes:

  • Update the release workflow to pass ${{ github.token }} as NODE_AUTH_TOKEN during the Docker build.
  • Update Dependabot’s GitHub Packages registry token reference from GH_NPM_PACKAGE_READ_TOKEN to GITHUB_TOKEN.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
.github/workflows/release-service.yaml Switches Docker build arg NODE_AUTH_TOKEN to use github.token instead of a PAT.
.github/dependabot.yml Updates the npm GitHub Packages registry token reference to secrets.GITHUB_TOKEN.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/release-service.yaml
Comment thread .github/dependabot.yml
Required for GITHUB_TOKEN to access private @zuplo npm packages
when explicit permissions are set on the job.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants