Rules Hub
Code Ruleset
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
Set the npm auth token env var once for the whole workflow instead of per step
Configure registry authentication once using an npmrc environment reference, and scope the token to the CI steps that need it.
Bad example
| 1 | - run: echo "//npm.pkg.github.com/:_authToken=${TOKEN}" >> .npmrc |
| 2 | # repeated before every install step |
Explanation (EN)
Repeatedly appending token text to a configuration file duplicates setup and increases secret exposure.
Objašnjenje (HR)
Good example
| 1 | # .npmrc |
| 2 | //registry.npmjs.org/:_authToken=${NPM_TOKEN} |
| 3 |
|
| 4 | # install step environment |
| 5 | env: |
| 6 | NPM_TOKEN: ${{ secrets.PACKAGE_READ_TOKEN }} |
Explanation (EN)
The variable name matches the npmrc reference and the secret is restricted to the install step.
Objašnjenje (HR)
Notes (EN)
For authenticated registry steps, configure one scoped npmrc environment-variable reference and expose the corresponding secret only to the job/steps that require it.
Exceptions / Tradeoffs (EN)
NPM_AUTH_TOKEN is not magical: npmrc must reference that name or the setup action must configure its expected variable, often NODE_AUTH_TOKEN. Avoid workflow-wide exposure to unrelated or untrusted steps.