Installing packages with the same scope from npm and GitHub Packages in the same project

[filiptammergard]

Select Topic Area

Question

Body

Hey!

Problem

We want to use GitHub Packages to publish and install private npm packages. Meanwhile, we want to publish and install our public npm package from the public npm registry.

We have an npm org and our public npm packages are all scoped as @org/package. It seems like a limitation with GitHub Packages is that we need to use the scope of the GitHub organization as @org/package.

This means the formats are the same. When installing a package from GitHub Packages, you need to configure an .npmrc file to make all packages with the org scope being downloaded from GitHub Packages.

I.e: @org:registry=https://npm.pkg.github.com

Let's say I have one public package @org/public-package hosted on npmjs.com, and a private package @org/private-package hosted on GitHub Packages.

Then I can't download them in the same project.

Suggestion

I'd suggest making it possible to use another scope for GitHub Packages, like suggested in https://github.com/orgs/community/discussions/40865.

Alternatives

The alternative for us would be to change the scope/naming structure of our public npm packages, but we really can't do that – it would not make sense to not use @org/package structure for the packages that are actually visible and available for anyone to install.

[michealroberts]

@filiptammergard , would it be possible to try something like this in your ./npmrc file:

registry=https://registry.npmjs.org/ <---- this is the default

@organisation:npm_package_name=https://registry.npmjs.org/ <--- some NPM package
//registry.npmjs.org/:_authToken=${NPM_TOKEN}

@organisation:github_package_name=https://npm.pkg.github.com <---- some GitHub package
//npm.pkg.github.com/:_authToken=${GITHUB_PACKAGES_AUTH_TOKEN}

[veritymedia]

Its late, but we were in a similar situation and we have a solution (not too pretty, but effective). In our release pipeline we simply push to both our npm and private github registries. That way we can continue using the private repo in our org scope but still getting the same public package.

[filiptammergard]

Thanks! I considered that solution, but would really like to avoid publishing to a private registry in our open source repos.

Doing this would also prevent us from actually downloading our public packages from npm, which would not be ideal.

Thanks for suggestion though!