Set up CI

CI installs and publishes through your Feed using short-lived credentials minted per run, so there are no long-lived registry secrets stored in the repository.

With your agent

"Wire our GitHub Actions to install and publish through PackageMaze."

Finds the workflows that install or publish packages.
Adds the setup-maze step and id-token: write permission where they belong.
Scopes each short-lived Token to the one step that uses it.
Leaves deployment-tool bootstraps alone unless you ask for them.

Requires a connected agent. See Connect your agent.

By hand

Before you start

Add GitHub Actions access for the repository from the Feed settings: an install rule for build, test, lint, and dependency jobs; a publish rule for the package publish workflow, constrained to the Package name when PackageMaze asks; and a separate docker-build rule for image builds that install packages inside Docker.

After the publish job is working, turn on Only allow publishing from approved CI jobs in Feed settings. PackageMaze will then block npm and PyPI publishes from developer machines and CI jobs without publish access. Packages already in the Feed will stay available.

Install jobs

Every job that installs from PackageMaze needs permissions.id-token: write and a packagemaze/[email protected] step before the package-client command. Inject the short-lived Token only into the step that needs it.

workflow permissions

permissions:
  contents: read
  id-token: write

npm install job

- id: packagemaze-token
  uses: packagemaze/[email protected]
  with:
    feed: <organization>/<feed>
    purpose: install
- uses: actions/setup-node@v6
  with:
    node-version: "24"
    registry-url: "https://pkg.packagemaze.com/<organization>/<feed>/"
- run: npm ci
  env:
    NODE_AUTH_TOKEN: ${{ steps.packagemaze-token.outputs.token }}

Publish jobs

Publishing runs from GitHub Actions with two Token steps: an install Token for dependency setup and build, then a publish Token for the upload. Publish requests include the Package name.

Package and Build pages show which CI job published each file. PackageMaze keeps only the verified details needed for that history and does not store the credentials used by the job.

publish job

- id: packagemaze-token
  uses: packagemaze/[email protected]
  with:
    feed: <organization>/<feed>
    purpose: install
- id: packagemaze-publish-token
  uses: packagemaze/[email protected]
  with:
    feed: <organization>/<feed>
    purpose: publish
    package: "openapi-typescript"

pnpm

pnpm ignores committed ${...} credential placeholders on current releases. In CI, write a trusted temp npm config, point pnpm at it with NPM_CONFIG_USERCONFIG, and inject the Token only into the pnpm step.

Docker image builds

Docker image builds pass the Token through a BuildKit secret so it never lands in image layers. Add a purpose: docker-build access rule, use one packagemaze/setup-maze step per Feed, and mount the generated secret only for the package-client RUN. The full Docker workflow and Dockerfile lines are rendered on the Feed Configuration page.

CircleCI

CircleCI is supported through OIDC token exchange with the maze CLI. Guided setup lives in the app's Feed Configuration page.