Skip to content

docs: install OpenChoreo plugins from public npm - #848

Open
kaviththiranga wants to merge 1 commit into
openchoreo:mainfrom
kaviththiranga:docs/npm-registry-cutover
Open

docs: install OpenChoreo plugins from public npm#848
kaviththiranga wants to merge 1 commit into
openchoreo:mainfrom
kaviththiranga:docs/npm-registry-cutover

Conversation

@kaviththiranga

Copy link
Copy Markdown
Contributor

Companion to openchoreo/backstage-plugins#771, which moves @openchoreo/* from GitHub Packages to the public npm registry.

Installing the plugins no longer requires a classic PAT with read:packages, an npmScopes block, or any registry configuration — yarn add works against a default registry setup.

All 24 packages are already live on npm (latest at 1.2.4), so these instructions are accurate as of today rather than pending the plugins PR merging.

Changes

  • installing-into-existing-backstage.mdx (current, v1.2.x, v1.1.x)
    • Intro now points at the npm org instead of GitHub Packages.
    • Section 3 "Authenticate to GitHub Packages" is retitled. The authentication half is removed, but the npmMinimalAgeGate / npmPreapprovedPackages guidance is kept — the 3-day age gate still blocks freshly published releases, and it matters more on public npm than it did before.
    • Added a note on verifying provenance with npm audit signatures.
  • troubleshooting.mdx (current, v1.2.x, v1.1.x): reworded the portal: fix, which referenced installing from GitHub Packages.
  • Removed the #authenticate-to-github-packages anchor together with its only inbound link, and updated the Section 9 legacy cross-reference that named "GitHub Packages auth".

Version accuracy

Versions 1.1.0 through 1.2.x were migrated to npm, so the v1.1.x and v1.2.x versioned docs correctly point there. Versions older than 1.1.0 were not migrated and remain on GitHub Packages — versioned_docs/version-v1.0.x and older never mentioned the registry, so they need no change.

Migrated versions carry no provenance attestation because they predate trusted publishing; only 1.3.0 onward will be attested. Both facts are stated in the docs rather than glossed over.

Verification

npm run build passes with no broken links (the removed anchor and its inbound link were deleted together).

Note for reviewers

#818 is open against the same install guide and will likely conflict. Happy to rebase whichever merges second.

@openchoreo/* now ships to the public npm registry, so installing no
longer needs a classic PAT with read:packages or an npmScopes block.
Keeps the npmMinimalAgeGate guidance, which still applies.

Signed-off-by: Kavith Lokuhewage <kaviththiranga@gmail.com>
@coderabbitai

coderabbitai Bot commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 4784654d-870b-40eb-9efa-6685e93844ec


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant