npmpackage.info

Gathering detailed insights and metrics for google-artifactregistry-auth

Other packages similar to google-artifactregistry-auth

@tkow/bun-google-artifactregistry-auth

0.0.1

google-artifactregistry-auth is an npm module that allows you to configure npm to interact with npm repositories stored in Artifact Registry with bunfig.

@google-cloud/artifact-registry

3.5.0

Artifactregistry client for Node.js

google-auth-library

9.15.0

Google APIs Authentication Client Library for Node.js

gtoken

7.1.0

Node.js Google Authentication Service Account Tokens

Gathering detailed insights and metrics for google-artifactregistry-auth

google-artifactregistry-auth

3.2.0

JavaScript

19,631,769 4.3

Installations

npm install google-artifactregistry-auth

Pull Requests

Open

9

Total

48

Closed

5

Merged

34

Issues

Open

7

Total

21

Closed

14

Releases

v3.2.0

Published on 30 Oct 2024

v3.1.2

Published on 01 Jun 2023

v3.1.1

Published on 27 Mar 2023

v3.1.0

Published on 09 Feb 2023

v3.0.2

Published on 31 Aug 2022

v3.0.1

Published on 07 Jun 2022

View all 8 releases

Developer

GoogleCloudPlatform

Developer Guide

BETA

Module System

CommonJS

Min. Node Version

Typescript Support

No

Node Version

14.21.3

NPM Version

6.14.18 Statistics

15 Stars

60 Commits

19 Forks

25 Watching

9 Branches

425 Contributors

Updated on 30 Oct 2024

Languages

JavaScript (100%)

Total Downloads

Cumulative downloads

Total Downloads

19,631,769

Last day

4.5%

65,173

Compared to previous day

Last week

5.3%

319,848

Compared to previous week

Last month

20.9%

1,314,010

Compared to previous month

Last year

97.9%

11,794,128

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

google-auth-library yargs

Dev Dependencies

mocha rewire

Versions

Artifact Registry tools for npm packages

This repository contains tools to simplify the process of working with npm packages using Artifact Registry.

Artifact Registry Module

The Artifact Registry google-artifactregistry-auth module is an npm package which allows you to configure npm to interact with npm private repositories in Artifact Registry.

For more details, see https://cloud.google.com/artifact-registry/docs/nodejs/authentication

The module automatically searches for credentials from the environment and authenticates to Artifact Registry. It looks for credentials in the following order:

Google Application Default Credentials.
The current active account logged in via gcloud auth login.
If neither of them exist, an error occurs.

NOTE: This module would update credentials for all Artifact Registry repositories. It would not be suitable if you use multiple account credentials in npmrc file.

To use the module:

Log in

Option 1: log in as a service account:

(1). Using a JSON file that contains a service account key:
```
   `$ export GOOGLE_APPLICATION_CREDENTIALS=[path/to/key.json]`
```
(2). Or using gcloud:
```
   `$ gcloud auth application-default login` 
```
Option 2: log in as an end user via gcloud:

$ gcloud auth login
Add settings to connect to the repository to .npmrc. Use the output from the following command:

$ gcloud artifacts print-settings npm
```
registry=https://LOCATION-npm.pkg.dev/PROJECT_ID/REPOSITORY_ID/
//LOCATION-npm.pkg.dev/PROJECT_ID/REPOSITORY_ID/:always-auth=true
```
Where

PROJECT_ID is the ID of the project.

REPOSITORY_ID is the ID of the repository.

LOCATION is the location of the repository.
Use one of these below options to run the script
1. Run the module outside of the directory containing the target npmrc file
  
  $ npx google-artifactregistry-auth --repo-config=[./.npmrc] --credential-config=[~/.npmrc]
2. Include the command in the scripts in package.json
```
"scripts": {
    "artifactregistry-login": "npx google-artifactregistry-auth --repo-config=[./.npmrc] --credential-config=[~/.npmrc]",
}
```
  Where:
  - --repo-config is the .npmrc file with your repository settings. If you don't specify this flag, the default location is the current directory.
  - --credential-config is the path to the .npmrc file where you want to write the access token. The default is your user .npmrc file.
  And then run the script
  
  $ npm run artifactregistry-login
3. npx should come with npm 5.2+. If npx is not available:
  
  Install the module from npmjs.com as a dev dependency and include the command in the script
  
  $ npm install google-artifactregistry-auth --save-dev
```
"scripts": {
    "artifactregistry-login": "./node_modules/.bin/artifactregistry-auth --repo-config=[./.npmrc] --credential-config=[~/.npmrc]",
}
```
  Run the script
  
  $ npm run artifactregistry-login

No vulnerabilities found.

10

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

9

License

Determines if the project has defined a license.

3

Maintained

Determines if the project is "actively maintained".

2

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yaml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/GoogleCloudPlatform/artifact-registry-npm-tools/publish.yaml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yaml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/GoogleCloudPlatform/artifact-registry-npm-tools/publish.yaml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yaml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/GoogleCloudPlatform/artifact-registry-npm-tools/publish.yaml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yaml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/GoogleCloudPlatform/artifact-registry-npm-tools/publish.yaml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/GoogleCloudPlatform/artifact-registry-npm-tools/tests.yaml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yaml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/GoogleCloudPlatform/artifact-registry-npm-tools/tests.yaml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yaml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/GoogleCloudPlatform/artifact-registry-npm-tools/tests.yaml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yaml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/GoogleCloudPlatform/artifact-registry-npm-tools/tests.yaml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yaml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/GoogleCloudPlatform/artifact-registry-npm-tools/tests.yaml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yaml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/GoogleCloudPlatform/artifact-registry-npm-tools/tests.yaml/master?enable=pin
Warn: npmCommand not pinned by hash: .github/workflows/tests.yaml:49
Warn: npmCommand not pinned by hash: .github/workflows/tests.yaml:22
Info: 0 out of 10 GitHub-owned GitHubAction dependencies pinned
Info: 1 out of 3 npmCommand dependencies pinned

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

0

Security-Policy

Determines if the project has published a security policy.

0

SAST

Determines if the project uses static code analysis.

Score

4.3

/10

Last Scanned on 2024-11-25

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More