docs: add private registry authentication recipes

[zkochan]

Private registry authentication already works through pnpm's pnpm_config__auth environment variable, so the action does not need dedicated registry inputs.

Add readable multiline JSON recipes for a scoped GitHub Packages token and a registry-wide default token using "@". Use toJSON to escape secrets, explain environment scope for later steps, and link to pnpm's _auth documentation.

Validation: parsed both recipes as YAML and JSON, verified secret escaping with quotes and backslashes, and ran git diff --check.

Replaces the approach proposed in #50.

[coderabbitai]

Warning

Review limit reached

Next included review available in 9 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: ccbd579a-3ae1-4a0e-a334-72ce96a53ff1

📥 Commits

Reviewing files that changed from the base of the PR and between c5b2e24 and 802fe57.

📒 Files selected for processing (1)

• README.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Document private registry authentication recipes

📝 Documentation 🕐 Less than 10 minutes

AI Description

• Documents pnpm private registry authentication without introducing action-specific inputs.
• Adds scoped and registry-wide token recipes with safe secret escaping.
• Clarifies environment scope, token precedence, and links pnpm authentication guidance.

Diagram

sequenceDiagram
  actor Workflow as Workflow
  participant Action as Setup Action
  participant Pnpm as pnpm Install
  participant Registry as Private Registry
  Workflow->>Action: Set auth environment
  Action->>Pnpm: Run install
  Pnpm->>Registry: Authenticate token
  Registry-->>Pnpm: Return packages

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Dedicated action registry inputs

• ➕ Makes registry authentication discoverable through action metadata.
• ➕ Could validate common registry and scope combinations before installation.
• ➖ Duplicates configuration already supported natively by pnpm.
• ➖ Expands the action API and creates an ongoing compatibility burden.
• ➖ May not represent multiple registries and scopes as flexibly.

2. Generate an .npmrc file

• ➕ Uses a familiar npm ecosystem configuration format.
• ➕ Can make authentication available to later workflow steps.
• ➖ Requires careful lifecycle management to avoid persisting secrets.
• ➖ Adds file-generation behavior and cleanup responsibilities to the action.
• ➖ Is less direct than passing pnpm's supported environment configuration.

Recommendation: Keep the PR's environment-variable documentation approach. It exposes pnpm's existing flexible authentication model, safely escapes secrets with toJSON, and avoids adding redundant action inputs or writing credential-bearing files; users needing authentication in later steps can deliberately promote the variable to job scope.

Files changed (1) +43 / -0

Documentation (1) +43 / -0

README.mdAdd private registry authentication recipes +43/-0

Add private registry authentication recipes

• Documents pnpm 11.10.0+ authentication through pnpm_config__auth with examples for scoped GitHub Packages access and registry-wide defaults. It explains safe secret escaping, scope precedence, environment lifetime, and links to pnpm's authoritative authentication documentation.

README.md

[greptile-apps]

Confidence Score: 5/5

The documentation-only change appears safe to merge.

_{Reviews (1) · Last reviewed commit: "docs: add private registry authenticatio..."}