How can I publish a free-tier org package in a private repo to github packages?

[atomicpages]

Select Topic Area

Question

Body

👋 hey there GH community. I've really been struggling to use GH packages in my workflow. Despite my efforts, I continue to get 403s when I push try and PUT packages in the registry. I have a pretty basic ts project setup that uses semantic-release to automate deployments. Here's the error I see:

npm notice Publishing to https://npm.pkg.github.com/ with tag latest and public access
npm ERR! code E403
npm ERR! 403 403 Forbidden - PUT https://npm.pkg.github.com/@nilai%2fcore - Permission permission_denied: The requested installation does not exist.
npm ERR! 403 In most cases, you or one of your dependencies are requesting
npm ERR! 403 a package version that is forbidden by your security policy, or
npm ERR! 403 on a server you do not have access to.

I can reproduce this error when I attempt to publish on my own machine using these commands:

npm login --scope=@MY_ORG --registry=https://npm.pkg.github.com

Below is the workflow:

on:
  - push
  - pull_request

jobs:
  cache-and-install:
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Install Node.js
        uses: actions/setup-node@v3
        with:
          node-version: 18
          registry-url: https://npm.pkg.github.com/

      - uses: pnpm/action-setup@v2
        with:
          version: 8
          run_install: false

      - name: Get pnpm store directory
        id: pnpm-cache
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

      - uses: actions/cache@v3
        name: Setup pnpm cache
        with:
          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: install and test
        run: pnpm install-test

      - name: build
        run: pnpm build

      - name: publish
        if: ${{ github.ref == 'refs/heads/main' }}
        env:
          NPM_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "@MY_ORG:registry=https://npm.pkg.github.com" > .npmrc
          echo "//npm.pkg.github.com/:_authToken=${NPM_TOKEN}" >> .npmrc
          pnpm semantic-release --debug

I've been searching various forums and websites for the last three days and nothing has worked 🥲. Can someone help?

[denisdifazio]

hey, have you found a way to make it work? i'm having the exact same problem here

[jakubriegel]

@denisdifazio have you found a way?

[denisdifazio]

hey guys, in the end i discovered that my problem was my package had the name field set with a different scope than the actual organization name on github. For example, in package.json it was set up like:

 "name": "@company/my-package",

and in github, the repo name was company-inc/my-package.

In order to make it work, they have to be exactly the same. So i changed my package.json to:

 "name": "@company-inc/my-package",

This is how i'm using it with lerna:

name: Versioning & Publishing

on:
  push:
    branches:
      - main

permissions:
  contents: write # for checkout and tag
  pull-requests: write # for comments
  packages: write # for publish

jobs:
  package-versioning:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: use nodejs 16
        uses: actions/setup-node@v3
        with:
          node-version: '16.x'
          registry-url: https://npm.pkg.github.com/
      - run: npm ci
      - name: versioning & publishing
        run: |
          git config user.name "ci"
          git config user.email "ci@github.com"
          npx lerna publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

[mohamed-moubarak]

@denisdifazio Thanks for posting your solution, you saved the day 🚀

[lop-Louis]

It is crazy we couldn't find such important info in the documentation.

[kaito-hao]

Thank you so much for saving my day!

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬