Private packages

Access ContractSpec on GitHub Packages

Affected @lssm-tech/* packages included in the July 7 rollout are distributed through GitHub Packages with restricted access. Pre-existing public/npmjs exceptions remain unchanged, including the unscoped contractspec CLI compatibility package. Ask for access first, then configure local and CI registry credentials before installing affected packages or running actions that install them.

2) Configure local registry auth

Export a token that can read the private packages. Keep real token values out of source control, examples, issue comments, and logs.

1export GITHUB_PACKAGES_TOKEN=<token-with-read-package-access>

1@contractspec:registry=https://npm.pkg.github.com
2@lssm-tech:registry=https://npm.pkg.github.com
3//npm.pkg.github.com/:_authToken=${GITHUB_PACKAGES_TOKEN}

1[install.scopes]
2"@contractspec" = { token = "$GITHUB_PACKAGES_TOKEN", url = "https://npm.pkg.github.com" }
3"@lssm-tech" = { token = "$GITHUB_PACKAGES_TOKEN", url = "https://npm.pkg.github.com" }

3) Use ContractSpec GitHub Actions

External repositories can still call ContractSpec actions. Pass a token with private package read access when the action needs to install or execute ContractSpec packages. The caller repository's github.token works only after that repository has package access.

1permissions:
2  contents: read
3  packages: read
4
5jobs:
6  contractspec:
7    runs-on: ubuntu-latest
8    steps:
9      - uses: actions/checkout@v6
10      - uses: lssm-tech/contractspec/packages/apps/action-pr@main
11        with:
12          github-packages-token: ${{ secrets.CONTRACTSPEC_PACKAGES_TOKEN }}
13          generate-command: 'bun contractspec generate'