Not wanting to store a secret in the package.json I’m trying to find the correct way to pass a secret for an organization repository as a dependency. If I reference the dependency:

"dependencies": {
  "@org/repo": "git+https://<REPO_TOKEN>:[email protected]/org/repo.git",
},

and I’ve created a .npmrc file with:

 - name: Create .npmrc
    run: echo "//npm.pkg.github.com/:_authToken=${{ secrets.REPO_TOKEN }}" >> .npmrc

created a root .env file with the token:

REPO_TOKEN=blahBlah

and when I run yarn I get the error message if:

Error: Failed to replace env in config: ${{ secrets.REPO_TOKEN }

In my user account settings I created the token from Developer Settings > Personal access tokens > Tokens (classic). Gave it the select scope settings of everything in repo:

Navigated back to the repo in the org I’m trying to pull in the dependency and navigated to Settings > Secrets and variables > Actions > Repository secrets and created a New repository secret named REPO_TOKEN.

Research:

• Install an npm module from a private GitHub repository using GitHub Actions
• npm install private github repositories by dependency in package.json

In an organizations repository I’m developing how can I use another organizations repository as a dependency without storing the secret as text in the package.json?