NPM

Common commands

npm install <package> --save|--global
npm uninstall <package>

GitLab NPM Registry

Authenticate

Personal access token

1. Go to the GitLab user account page and open Access Tokens.
2. Add a new token with api access and save it.
3. Copy and store the token safely.
4. Set the authentication token.

npm config set -- "//gitlab.example.com/api/v4/packages/npm/:_authToken" "<token>"

Scope

The scope is usually the root namespace in GitLab.

For example: https://gitlab.com/jckoh/software-v2/lib/logger

The scope is jckoh.

Library development

1. Create an empty directory.
2. Initialize the npm project and fill in the required information. For the package name, follow the GitLab documentation: Package Naming Convention

npm init

3. Create .npmrc in the project directory.
4. Configure the npm registry.

npm config set @<scope>:registry https://gitlab.com/api/v4/projects/<project_id>/packages/npm/

npm config set -- '//gitlab.com/api/v4/projects/<project_id>/packages/npm/:_authToken' "<token>"

5. Publish the package.

npm publish

6. You can also define the publish config in package.json.

{
    "publishConfig": { "@<scope>:registry":" https://gitlab.com/api/v4/projects/<project_id>/packages/npm/" }
}

Using private npm packages

1. Set the scope.

npm config set @<scope>:registry https://gitlab.com/api/v4/packages/npm/

2. Install the npm package.

    npm install @scope/package

Publish to the public npmjs.com registry

1. Init:

npm init --scope=@scope-name

2. Publish:

npm publish --access public

pnpm

Workspace

Create pnpm-workspace.yaml in the root folder:

packages:
  - apps/*
  - packages/*
  - test/*

To install a library to an app:

pnpm add @company/lib --filter ./ --workspace

Link library

pnpm add file:<path to library>

# At library you want to share
pnpm link 

# At project want to use library
pnpm link <pkg>

Security

Minimum Release Age

npm

; per project (./.npmrc) or global (~/.npmrc) 
min-release-age=7

pnpm

# per project (./pnpm-workspace.yaml) or global (~/.config/pnpm/config.yaml)
minimumReleaseAge: 10080

bun

# per project (./bunfig.toml) or global ($HOME/.bunfig.toml) or ($XDG_CONFIG_HOME/.bunfig.toml)
[install]
minimumReleaseAge = 604800

Disable install scripts

npm

# .npmrc
ignore-scripts=true

Block git dependencies

npm

# .npmrc
allow-git=none
# or
allow-git=root

pnpm

# pnpm-workspace.yaml
blockExoticSubdeps: true
trustPolicy: no-downgrade