3

For all the other stackoverflow questions, it seems like people are asking either about a private npm git repository or about a different technology stack. I'm pretty sure I can use a private npm registry with GAE Flexible, but I was wondering if it was possible with the Standard version?

From the GAE standard docs, doesn't seem like it is possible. Anyone else figure out otherwise?

ahong
  • 1,041
  • 2
  • 10
  • 22

1 Answers1

3

Google marked this feature request as "won't fix, intended behavior" but there is a workaround.

Presumably you have access to the environment variables during the build stage of your CI/CD pipeline. Begin that stage by having your build script overwrite the .npmrc file using the value of the environment variable (note: the value, not the variable name). The .npmrc file (and the token in it) will then be available to the rest of the CI/CD pipeline.

For example:

  - name: Install and build
    env:
      NPM_AUTH_TOKEN: ${{ secrets.PRIVATE_REPO_PACKAGE_READ_TOKEN }}
    run: |
      # Remove these 'echo' statements after we migrate off of Google App Engine.
      # See replies 14 and 18 here: https://issuetracker.google.com/issues/143810864?pli=1
      echo "//npm.pkg.github.com/:_authToken=${NPM_AUTH_TOKEN}" > .npmrc
      echo "@organizationname:registry=https://npm.pkg.github.com" >> .npmrc
      echo "always-auth=true" >> .npmrc
      npm install
      npm run compile
      npm run secrets:get ${{ secrets.YOUR_GCP_PROJECT_ID }}

Hat tip to the anonymous heroes who wrote replies 14 and 18 in the Issure Tracker thread - https://issuetracker.google.com/issues/143810864?pli=1

If you have a .npmrc file checked in with your project's code, you would be wise to put a comment at the top, explaining that it will be overwritten during the CI/CD pipeline. Otherwise, Murphy's Law dictates that you (or a teammate) will check in a change to that .npmrc file and then waste an unbounded amount of time trying to figure out why that change has no effect during deployment.

NateWaddoups
  • 46
  • 4
  • Great answer. We were going to move towards private repos, but haven't done so because of issues like this. Not sure when I would be able to verify this solution, but it seems like a lot of people in the issue tracker say it works, so I will take your word for it. – ahong Jan 26 '22 at 06:52