Releasing Utilities Package to GitHub Packages: A Guide
Releasing a closed-source, reusable JavaScript/TypeScript package for internal use across both frontend and backend can present challenges. This article outlines a stable, repeatable workflow utilizing GitHub Packages to overcome these challenges.
Releasing a closed-source, reusable JavaScript/TypeScript package for internal use across both frontend and backend can present challenges. This article outlines a stable, repeatable workflow utilizing GitHub Packages to overcome these challenges.
When utilities are strictly internal, or involve private contract processing logic, GitHub’s registry offers several advantages:
Repository Integration: No additional accounts or keys are required. Scoped Access: Provides control over who can access the code. Consistent Workflows: Leverages existing GitHub workflows.
Distributable code is maintained within the /package directory to prevent accidental exposure of development files. The structure is as follows:
|-- .github/ |-- src/ |-- package/ # Only published files reside here |-- package.json |-- dist/ |-- index.js |-- ...
Note: The npm publish command is executed within the /package directory.
Each package update is tagged as a release in GitHub’s UI to prevent accidental release of incomplete work.
The following workflow automates the package publishing process on GitHub Packages:
Releasing a closed-source, reusable JavaScript/TypeScript package for internal use across both frontend and backend can present challenges.
jobs: publish: runs-on: ubuntu-latest permissions: contents: read packages: write
with: node-version: 18 registry-url: "https://npm.pkg.github.com" scope: "@your-user-name" always-auth: true
- uses: actions/setup-node@v3
run: npm ci
- name: Install dependencies
run: npm run package
- name: Build package
working-directory: ./package run: npm ci
- name: Install package dependencies
working-directory: ./package run: npm publish env: NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Publish package
Place this file at github/workflows/publish.yml .
Scopes, Not Monorepos: No workspaces or publishing the entire repository. No Source Leakage: Only files in /package are available to consumers. Manual Trigger: The process is initiated only upon creating a GitHub Release.
Upon updating a Smart Contracts ABI in /src , run an internal build script to output to /package/dist . Only this transpiled, dependency-free version will be deployed.
npm install @user/package-name --registry=https://npm.pkg.github.com
This process allows access from both backend and frontend without npmjs exposure.
Based on reporting by hackernoon.com.