Installing in CI / automated environments

This guide is for teams and individuals who need to install @linkurious/ogma in a CI pipeline, a shared project, or any environment where the download secret must not appear in package.json, lockfiles, or build logs.

Why not the direct URL?

The standard install URL contains your API key (download secret) in plain text:

https://get.linkurio.us/api/get/npm/ogma/<VERSION>/?secret=<YOUR_API_KEY>

When that URL is placed in package.json, it ends up committed to git and visible in lockfiles, build logs, and to every developer who clones the repository. The .npmrc approach moves the secret into an environment variable that is never written to disk as plaintext.

Step 1 — Extract your secret from the download link

Open get.linkurio.us, log in, and copy the npm install link for Ogma. It looks like:

https://get.linkurio.us/api/get/npm/ogma/<VERSION>/?secret=lk-dls-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The part after ?secret= is your personal download secret. You will need it in the next step.

Step 2 — Build the OGMA_DOWNLOAD_KEY value

The private registry uses HTTP Basic Auth, encoded as base64(username:password). The username is the email address you use to log in to get.linkurio.us; the password is your download secret.

Run this once in your shell to see what the value looks like:

printf '%s' '<YOUR_EMAIL>:<YOUR_SECRET>' | base64
# example: printf '%s' 'alice@example.com:lk-dls-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' | base64

The output is the string you will store as the OGMA_DOWNLOAD_KEY environment variable.

On Linux/macOS — add it to your shell profile or export it before running npm install:

export OGMA_DOWNLOAD_KEY=$(printf '%s' '<YOUR_EMAIL>:<YOUR_SECRET>' | base64)

On Windows (PowerShell):

$env:OGMA_DOWNLOAD_KEY = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("<YOUR_EMAIL>:<YOUR_SECRET>"))

Never commit the raw secret or the computed base64 string to git. Store it only in environment variables, CI secret vaults, or a local .env file that is listed in .gitignore.

Step 3 — Create .npmrc in your project root

@linkurious:registry=https://public-pull.nexus3.linkurious.net/repository/npm-public/
//public-pull.nexus3.linkurious.net/repository/npm-public/:_auth=${OGMA_DOWNLOAD_KEY}
//public-pull.nexus3.linkurious.net/repository/npm-public/:always-auth=true

This file is safe to commit. It contains only the environment variable placeholder ${OGMA_DOWNLOAD_KEY}, not the actual secret. npm expands the variable at install time.

Step 4 — Add Ogma as a normal semver dependency

Replace any direct URL dependency in package.json with a normal version:

{
  "dependencies": {
    "@linkurious/ogma": "<VERSION>"
  }
}

Step 5 — Install

Make sure OGMA_DOWNLOAD_KEY is set in your environment, then run:

npm install
# or, in CI where you want a reproducible install:
npm ci

npm will resolve @linkurious/ogma through the private registry defined in .npmrc and authenticate with the base64 credential automatically.

CI examples

In any CI system, add OGMA_DOWNLOAD_KEY as a secret environment variable and make it available to the install step. Because .npmrc is already committed with the ${OGMA_DOWNLOAD_KEY} placeholder, no extra setup is needed — just ensure the secret is injected before npm ci runs.

GitHub Actions:

- name: Install dependencies
  run: npm ci
  env:
    OGMA_DOWNLOAD_KEY: ${{ secrets.OGMA_DOWNLOAD_KEY }}

Jenkins:

environment {
    OGMA_DOWNLOAD_KEY = credentials('ogma-download-key')
}
stages {
    stage('Install') {
        steps {
            sh 'npm ci'
        }
    }
}