NPM

Common commands

npm install <package> --save|--global
npm uninstall <package>

Gitlab NPM Registry

Authenticate

Personal access token

1. Go to gitlab user account > Access Tokens
2. Add a new token with api access and save
3. Copy and save the token
4. Set authentication

npm config set -- "//gitlab.example.com/api/v4/packages/npm/:_authToken" "<token>"

Scope

Scope will be the root of your gitlab. For example: https://gitlab.com/jckoh/software-v2/lib/logger

The scope will be jckoh

Library development

1. Create empty directory
2. Initialize npm project and fill in required information, for package name, follow gitlab documentation Package Naming Convention

npm init

3. Create .npmrc at project directory
4. Configure npm registry

npm config set @<scope>:registry https://gitlab.com/api/v4/projects/<project_id>/packages/npm/

npm config set -- '//gitlab.com/api/v4/projects/<project_id>/packages/npm/:_authToken' "<token>"

5. Publish your npm using

npm publish

6. You also can define your publish config at package.json.

{
    "publishConfig": { "@<scope>:registry":" https://gitlab.com/api/v4/projects/<project_id>/packages/npm/" }
}

Using private npm

1. Set the scope

npm config set @<scope>:registry https://gitlab.com/api/v4/packages/npm/

2. Install npm package

    npm install @scope/package

publish to npmjs.com public repository

1. Init

npm init --scope=@scope-name

2. Publish

npm publish --access public

Pnpm

Workspace

create pnpm-workspace.yaml file in the root folder

packages:
  - apps/*
  - packages/*
  - test/*

To install a library to an app

pnpm add @company/lib --filter ./ --workspace

Link library

pnpm add file:<path to library>

# At library you want to share
pnpm link 

# At project want to use library
pnpm link <pkg>

Security

Minimum Release Age

npm

; per project (./.npmrc) or global (~/.npmrc) 
min-release-age=7

pnpm

# per project (./pnpm-workspace.yaml) or global (~/.config/pnpm/config.yaml)
minimumReleaseAge: 10080

bun

# per project (./bunfig.toml) or global ($HOME/.bunfig.toml) or ($XDG_CONFIG_HOME/.bunfig.toml)
[install]
minimumReleaseAge = 604800

Disable install scripts

npm

# .npmrc
ignore-scripts=true

Block git dependencies

npm

# .npmrc
allow-git=none
# or
allow-git=root

pnpm

# pnpm-workspace.yaml
blockExoticSubdeps: true
trustPolicy: no-downgrade