Documentation

Point your package manager at us, then decide how strict to be.

Tokens

Read tokens for CI, read-write for publishers, both scoped to an ecosystem and optionally to a package prefix.

CI configuration

bash

# GitHub Actions
- run: |
    echo "registry=https://parcel.build/npm/acme/" >> .npmrc
    echo "//parcel.build/npm/acme/:_authToken=${{ secrets.PARCEL }}" >> .npmrc
    npm ci

Keep require-hashes or a lockfile in CI. The proxy does not change artefact bytes, so hash pinning works exactly as it does against the public registry — and it is your last line of defence if our cache is ever wrong.

Quarantine

json

{
  "quarantine": {
    "default_hold": "24h",
    "per_ecosystem": {"npm": "48h", "go": "0h"},
    "block_on": ["provenance_mismatch", "advisory"],
    "flag_on": ["typosquat", "new_maintainer"],
    "notify": ["#supply-chain"]
  }
}

Shadowing rules

The rule that prevents dependency confusion: names matching your internal prefixes never resolve upstream, even if a public package with that name appears.

json

{
  "private_prefixes": ["@acme/", "acme_"],
  "on_upstream_conflict": "block_and_alert"
}

Policy as code

The whole policy is a document you can keep in git and apply through CI. Changes are versioned and every resolution decision records which policy version produced it.

Private packages

bash

npm publish --registry https://parcel.build/npm/acme/
twine upload --repository-url https://parcel.build/pypi/acme/ dist/*
cargo publish --registry parcel

SBOM export

bash

parcel sbom export --repo acme/api --format cyclonedx-json
parcel inventory query --licence 'AGPL-3.0' --format csv