Private package registries

If your project installs private packages, give PatchWave read access to your registry. PatchWave needs it to review updates to those packages and to build and test fixes.

Why you need a separate token

The PatchWave GitHub app can read your selected repositories, but not your package registries. GitHub Packages only accepts personal access tokens (classic) and rejects app tokens, even for packages published from repositories the app can read. To ask GitHub for fine-grained token support, upvote this community discussion.

Set up your registry

PatchWave passes your secrets to your package manager and build as environment variables. Saving a secret doesn’t configure your registry, so commit a configuration that reads those variables. Commit only the variable references, never token values.

npm

Create an npm granular access token with Read-only access to the required packages or scopes.

Commit a project .npmrc that references the token variable, as described in npm’s CI guide:

.npmrc

//registry.npmjs.org/:_authToken=${NPM_TOKEN}

Save the token as a PatchWave secret named NPM_TOKEN. If your configuration already reads another variable, use that name instead.

GitHub Packages

1. Using a GitHub account that can read your packages, create a personal access token (classic) with only the read:packages scope. By default, a package linked to a repository has that repository’s access. For other packages, grant the account access in the package’s settings.
2. If your organization uses SAML SSO, authorize the token for the organization.

Patch says

I recommend creating the token on a bot account instead of your own. A token can read every package its owner can, and it stops working if its owner leaves your organization. Give the bot read access to the repositories that publish your packages.

npm packages

Configure your package scope to use GitHub’s npm registry. Replace your-org with the scope of your packages:

.npmrc

@your-org:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${NPM_TOKEN}

Save the token as a PatchWave secret named NPM_TOKEN.

Maven packages

Add a server entry like this to the settings file your build uses. The server ID must match your repository ID. Maven settings can read environment variables:

.mvn/settings.xml

<settings>
  <servers>
    <server>
      <id>github</id>
      <username>${env.MAVEN_USERNAME}</username>
      <password>${env.MAVEN_TOKEN}</password>
    </server>
  </servers>
</settings>

Configure the repository URL following GitHub’s Maven registry guide. Pass the settings file to Maven with mvn -s .mvn/settings.xml verify.

Add PatchWave secrets named MAVEN_USERNAME for the token owner’s username and MAVEN_TOKEN for the token.

sbt packages

sbt doesn’t read Maven’s settings file, so configure the resolver and credentials in build.sbt. Replace your-org/your-repo with the repository that publishes the packages, and add a resolver for each repository you install from. Keep the realm and host as shown:

build.sbt

ThisBuild / resolvers += "GitHub Packages" at "https://maven.pkg.github.com/your-org/your-repo"

ThisBuild / credentials ++= sys.env.get("GITHUB_TOKEN").toSeq.map { token =>
  Credentials("GitHub Package Registry", "maven.pkg.github.com", sys.env("GITHUB_USERNAME"), token)
}

Add PatchWave secrets named GITHUB_USERNAME for the token owner’s username and GITHUB_TOKEN for the token.

Other registries

For other registries, create a token that can read the packages you install. Scope names vary by registry. Configure your build to read the token, and any username it needs, from environment variables. Then add PatchWave secrets with those exact names.

Email us if you need help with a registry not covered here.

Add a PatchWave secret

You must be a PatchWave workspace admin to manage secrets.

1. Open Settings → Secrets in the workspace that owns the repository.
2. Choose the scope. A workspace secret is the default for every repository in the workspace. A repository secret applies to one repository; use it to limit a token to one project.
3. Name the secret after the environment variable your build reads, paste the token, and save.
4. Add any other credentials your registry needs, such as a username, the same way.

A repository secret overrides a workspace secret with the same name. You can replace or delete a saved secret, but you can’t view its value. See Security and privacy for how PatchWave handles secrets.

When a token expires, PatchWave can’t review updates to your private packages or build fixes that install them. Replace the PatchWave secret before the token expires.