Published NPM package with shockingly

[Torben]

I just bought the Premium Club level because I want to publish an NPM package that uses the Draggable and Inertia plugins.

I believe I'm allowed to do that right?

 

I'm confused about how to add it to my project. If I add it with the

npm install gsap@npm:@gsap/shockingly

And add the .npmrc file with the token.

After I publish it and try to install in a new project with "npm install my-package" I get an error saying "@gsap/shockingly@^3.12.5' is not in the npm registry."
I guess that is because the .npmrc file is not published, which is a bad idea to do because that has my token in it.

 

If I try to use the downloaded files I would have to publish the file to the repo and sine that is a public repo it would be available to eveyone to download, including the bonus stuff.

 

How do I do this?

[mvaneijgen]

Hi @Torben, 

 

This depends on your host. For instance on Netlify you can create Environment variables which allows you to add secrets which get used in the build process. And a guide has been written how to set it up, it's probably similar to your host and someone has probably asked a similar question "how do I publish to ... {insert your host}" on the forum . If you can't find a solution, just post here with what you're working with  and someone will point you in the right direction. Hope it helps and happy tweening! 

 

https://gsap.com/docs/v3/Installation/guides/Club GSAP & Netlify/

[Torben]

Thanks, but that's not the issue here.

 

I have published an NPM package where I'm using bonus plugins.

 

When I try to install that package with "npm install my-package" I get the errors mentioned in the first post.

[GreenSock]

@Torben you published a public NPM package that uses members-only plugins? Yikes. 🫣 

 

What would you expect to happen if a random person installed your package? It shouldn't be able to leverage those plugins of course. So yeah, this would all depend on your having your local .npmrc file set up properly so that it accurately resolves that repository to the npm.greensock.com one and passes along your token. And you're absolutely right about making sure you don't put that in your repository because it'd have your token in there which should never be shared. 

[Torben]

No I didn’t because it didn’t work 🙂

But of course I get your point and making it a private repo and a private package is fine which would also solve the problem so thank you. 

[m__shum]

On 3/11/2024 at 3:58 AM, mvaneijgen said:

Hi @Torben, 

 

This depends on your host. For instance on Netlify you can create Environment variables which allows you to add secrets which get used in the build process. And a guide has been written how to set it up, it's probably similar to your host and someone has probably asked a similar question "how do I publish to ... {insert your host}" on the forum . If you can't find a solution, just post here with what you're working with  and someone will point you in the right direction. Hope it helps and happy tweening! 

 

https://gsap.com/docs/v3/Installation/guides/Club GSAP & Netlify/

Why do you have to change the token in dev mode? Surely reading it from the .env file should be adequate? Having to change this every time you want to make a commit is a massive headache.

I've tried time and time again to use the gsap token from the env file and keep getting the same 'bad auth' error.  I've tried setting it as a plain env variable, I've tried exporting it in the env file, I've tried prefixing it with NPM_CONFIG, nothing works.

Nevermind, I didn't realise that you had to store the env variable in bash for it to be replaced in npmrc locally. Today I learned.