My initial thought was to utilize .npmrc for v1 or .yarnrc.yml for v2/3/4, but in all scenarios, Yarn does not even attempt to authenticate with Github.
nodeLinker: node-modules
npmScopes:
packagescope:
npmAlwaysAuth: true
npmAuthToken: my_personal_access_token
npmRegistryServer: "https://npm.pkg.github.com"
yarnPath: .yarn/releases/yarn-3.6.2.cjs
The error message received is as follows:
error Command failed.
Exit code: 128
Command: git
Arguments: ls-remote --tags --heads https://github.com/user/some-dependency.git
Directory: /home/me/Documents/projects/myapp
Output:
fatal: could not read Username for 'https://github.com': terminal prompts disabled
Upon checking github.com, it appears that the access token has never been utilized, indicating that authentication is not being attempted at all.
Is there a way to install the repository using access tokens without embedding them directly into package.json? While hardcoding them into package.json did work, it is a security risk, may interfere with git bisect, and presents other drawbacks.
Utilizing SSH is not a viable option since CI servers from third parties need to access this, and I am cautious about granting unrestricted access to our repositories.