unkin-agent
42998a80f4
In-house npm packages have nowhere to publish: npm locals only accept raw file uploads, which `npm publish` and `npm install` cannot use. - accept `npm publish` (`PUT /api/v1/local/<repo>/<pkg>`, scoped included) on local npm repos, capping the body at 256MiB and verifying the tarball against dist integrity - write tarball, then manifest, then dist-tags; publishing an existing version returns 409 and leaves tags alone, while a matching leftover tarball from a failed publish is reused so retries complete - serve packuments with tarball URLs pointing back at the local repo, dropping dist-tags that name unpublished versions - document the `.npmrc` registry + `_authToken` setup in the UI and `docs/npm/local.md` - add a stock `node:22` publish/install e2e-docker case Reviewed-on: #139 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
15 lines
542 B
Markdown
15 lines
542 B
Markdown
# Local npm registry
|
|
|
|
A local `npm` repo is a real npm registry: `npm publish` (scoped and unscoped)
|
|
and `npm install` work against `/api/v1/local/<repo>/`. npm requires an
|
|
`_authToken` for the registry before it will publish; any value works.
|
|
|
|
```ini
|
|
# .npmrc
|
|
registry=https://artifactapi.example.com/api/v1/local/<repo>/
|
|
//artifactapi.example.com/api/v1/local/<repo>/:_authToken=unused
|
|
```
|
|
|
|
Versions are immutable: republishing an existing version is rejected. The
|
|
dist-tags sent with a publish (`latest`, or `--tag`) move to that version.
|