Private npm registry setup

A private npm registry setup has three moving parts: the registry URL, the token, and the package scope.

Local setup

npm config set @acme:registry https://npm.pkg.rvsta.sh/x/_wsabc123/_repo1234/
npm config set //npm.pkg.rvsta.sh/x/_wsabc123/_repo1234/:_authToken "${RAVENSTASH_TOKEN}"

Use the same .npmrc shape for npm-compatible clients.

CI setup

Store RAVENSTASH_TOKEN in your CI secret manager. Generate .npmrc during the job so tokens do not appear in the repository.

cat > .npmrc <<'EOF'
@acme:registry=https://npm.pkg.rvsta.sh/x/_wsabc123/_repo1234/
//npm.pkg.rvsta.sh/x/_wsabc123/_repo1234/:_authToken=${RAVENSTASH_TOKEN}
EOF
npm publish --registry https://npm.push.rvsta.sh/x/_wsabc123/_repo1234/

Current boundaries

Ravenstash supports private npm publishing, package and version data, tarball downloads, registry ping, and mutable dist-tag management.