Github update dependencies fails with private registry

[eriklztiqqe]

We have multiple repositories, which have dependencies towards AWS CDK constructs in private npm registries (Github packages, later possibly Cloudsmith).

To access these constructs we thus need NPM_TOKEN exposed, but the update dependencies workflow does not include this, only GITHUB_TOKEN.
This causes the workflow to fail each time and we get an email notification about it. Currently, that includes about 13-14 repositories, and there will be more.

This is kind of related to #815, which also concerns the lack of exposed variables, but a different use case.

[jumic]

You can use workflowBootstrapSteps to add additional steps to your workflow. I used the following code snippet:

workflowBootstrapSteps: [{
  name: 'npmjs login',
  run: 'echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc',
  env: {
    NPM_TOKEN: '${{ secrets.NPM_TOKEN }}',
  },
}],

It creates file .npmrc including the NPM_TOKEN. In my example project I was able to use a private package from npm.js in my upgrade workflow.

[github-actions]

This issue is now marked as stale because it hasn't seen activity for a while. Add a comment or it will be closed soon.

[github-actions]

Closing this issue as it hasn't seen activity for a while. Please add a comment @mentioning a maintainer to reopen.