# CI/CD pipeline with private github package?

**URL:** https://forum.serverless.com/t/ci-cd-pipeline-with-private-github-package/11738
**Category:** Serverless Framework
**Tags:** cicd
**Created:** [June 10, 2020, 1:35pm UTC](https://forum.serverless.com/t/ci-cd-pipeline-with-private-github-package/11738 "2020-06-10T13:35:07Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Denjul](https://avatars.discourse-cdn.com/v4/letter/d/b77776/32.png) [@Denjul](https://forum.serverless.com/u/Denjul)
#### Post date: [June 10, 2020, 1:35pm UTC](https://forum.serverless.com/t/ci-cd-pipeline-with-private-github-package/11738/1 "2020-06-10T13:35:07Z")

</div>

Hi!

At the moment I use codebuild for my CI/CD pipeline and want to change it to serverless framework if it is possible. But running into a problem with my private github package.

I want a secure way to put my token to my github package.  
At the moment in codebuild:  
I have the github token as a environment variable and in my buildspec file i run  
`echo "//npm.pkg.github.com/:_authToken=$NPM_TOKEN" > ~/.npmrc`  
before the  
`yarn install`

i have tried to run that script in preinstall in package.json while also having the NPM\_TOKEN in deployment profile parameters:

```auto
   "scripts": {
    "preinstall": "echo '//npm.pkg.github.com/:_authToken=$NPM_TOKEN' > ~/.npmrc"
  },

```

But i get:

```auto
build step: yarn install

```

```auto
yarn install v1.22.4

```

```auto
$ echo '//npm.pkg.github.com/:_authToken=$NPM_TOKEN' > ~/.npmrc

```

```auto
[1/4] Resolving packages...

```

```auto
[2/4] Fetching packages...

```

```auto
error An unexpected error occurred Request failed \"401 Unauthorized\""

```

I want the token in “deployment profile parameters”, but can’t “inject” it somewhere to make it work with yarn install. Anyone know any solution or have any workaround?

---

<div class="post-metadata">

### Author: ![cmendes0101](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/cmendes0101/32/4503_2.png) [@cmendes0101](https://forum.serverless.com/u/cmendes0101)
#### Post date: [August 21, 2020, 7:59am UTC](https://forum.serverless.com/t/ci-cd-pipeline-with-private-github-package/11738/2 "2020-08-21T07:59:49Z")

</div>

This is probably too late but just wanted to leave a comment for anyone else who finds this.

To avoid the preinstall step, just create a .npmrc file at the project root. Then add a variable for the token:  
`//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}`

Make sure to add a secured parameter GITHUB\_TOKEN in the project stage profile.

---

<div class="post-metadata">

### Author: ![creaux](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/creaux/32/5051_2.png) [@creaux](https://forum.serverless.com/u/creaux)
#### Post date: [January 12, 2021, 11:19pm UTC](https://forum.serverless.com/t/ci-cd-pipeline-with-private-github-package/11738/3 "2021-01-12T23:19:51Z")

</div>

Actually with even there is .npmrc with `registry=https://registry.npmjs.org/:_authToken=${NPM_TOKEN}` and NPM\_TOKEN set in parameters I’m getting:

```
build step: npm ci --if-present --unsafe-perm
Error: Failed to replace env in config: ${NPM_TOKEN}
```