You need only to use .npmrc in the root of your project with this content:

//npm.pkg.github.com/:_authToken=GITHUB_PERSONAL_TOKEN
@OWNER:registry=https://npm.pkg.github.com

Keep in mind that GITHUB_PERSONAL_TOKEN needs read:packages scope permissions in order to read the packages from your private repo.

I am adding an answer here because after a day of trying different variations of the solutions here and elsewhere, I found that my issue was something else.

My issue was that, while npm is not case sensitive with regards to package names, yarn is when it comes to authentication! 🤦‍♂️

So, using the example from this solution:

registry=https://registry.yarnpkg.com/

@GITHUB_USERNAME:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=AUTH_TOKEN
always-auth=true

I needed to ensure two things:

1. @GITHUB_USERNAME needs to match the case that you see on github and the name the package was published under. I.e., if your username is Pickle-Rick, you need to put @Pickle-Rick:registry=https://npm.pkg.github.com, not @pickle-rick or @Pickle-rick.

2. You need to match this casing in your package.json or your yarn add command - whichever you are using. For example:

   "@Pickle-Rick/schwifty": "^1.0.0" in package.json or yarn add @Pickle-Rick/schwifty.

I found this solution by digging through yarn github issues.

How we solved this at work

Late to the party, but just had this issue at work, specifically when using yarn as the package manager. This worked for us...

(the key was this documentation for actions/setup-node)

Context:

• All repos/packages are stored under our github Organisation and are private
• 1 repo which publishes a github npm package
• 1 repo which consumes the package
• Yarn v4.3.1

Solution for yarn install locally:

• all devs create a .yarnrc.yml in their home folder. Eg. ~/.yarnrc.yml
• each dev creates a personal access token on github to use in this local yarn config

# ~/.yarnrc.yml
npmRegistryServer: https://registry.yarnpkg.com

npmScopes: {
  Octopus-Moneycoach: {
    npmRegistryServer: https://npm.pkg.github.com,
    npmAlwaysAuth: true,
    npmAuthToken: PERSONAL_ACCESS_TOKEN,
  },
}

Solution for yarn install in Github workflow:

• repo/package set up to allow read access to the consuming repo
• Consuming repo has step in workflow .yml before the step containing yarn install. Step points to a custom composite action in repo under .github/actions/setup-yarnrc/action.yml

# .github/actions/setup-yarnrc/action.yml

# See https://github.com/actions/setup-node/blob/main/docs/advanced-usage.md#yarn2-configuration

name: "Setup .yarnrc.yml"
description: "Creates the .yarnrc.yml file needed to authenticate with the GitHub npm registry."
inputs:
  NPM_AUTH_TOKEN:
    description: "The GitHub token to use for authentication."
    required: true
runs:
  using: "composite"
  steps:
    - name: Setup Node.js environment
      uses: actions/setup-node@v4
      with:
        node-version: 20

    - name: Setup .yarnrc.yml
      run: |
        yarn config set npmScopes.<GITHUB_ORG_NAME>.npmRegistryServer "https://npm.pkg.github.com"
        yarn config set npmScopes.<GITHUB_ORG_NAME>.npmAlwaysAuth true
        yarn config set npmScopes.<GITHUB_ORG_NAME>.npmAuthToken $NPM_AUTH_TOKEN
      shell: bash
      env:
        NPM_AUTH_TOKEN: ${{ inputs.NPM_AUTH_TOKEN }}

With this composite action created, you can call it from your workflow. For example, our workflow that runs on every PR looks like this:

# .github/workflows/pull-request-triage.yml

name: Pull Request Triage

on:
  pull_request:
    branches:
      - develop
    types: [opened, reopened, synchronize, ready_for_review]

jobs:
  pr-triage:
    name: PR triage
    runs-on: ubuntu-latest
    if: ${{ !github.event.pull_request.draft }}
    steps:
      - name: Check out code
        uses: actions/checkout@v4

      # -----------------------------------------------
      # This step calls the composite action 
      # to create the `.yarnrc.yml` in the workflow

      - name: Setup .yarnrc.yml
        uses: ./.github/actions/setup-yarnrc
        with:
          NPM_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      # -----------------------------------------------

      - name: Cache node modules
        uses: actions/cache@v4
        with:
          path: node_modules
          key: yarn-deps-${{ hashFiles('yarn.lock') }}
          restore-keys: |
            yarn-deps-${{ hashFiles('yarn.lock') }}

      - name: Install dependencies
        run: yarn install --immutable

      - name: Lint
        run: yarn lint

      - name: Test
        run: yarn test

This is what worked for me using Yarn V1

# .npmrc
@vesato:registry=https://gitlab.com/api/v4/projects/[xx]/packages/npm/
//gitlab.com/api/v4/projects/[xx]/packages/npm/:_authToken=${NPM_TOKEN}

And this is what worked after changing to Yarn V2

# .yarnrc.yml

nodeLinker: pnp

npmScopes:
  "vesato":
    npmAlwaysAuth: true
    npmRegistryServer: https://gitlab.com/api/v4/projects/[xx]/packages/npm/
    npmAuthToken: "${NPM_TOKEN}"

yarnPath: .yarn/releases/yarn-3.2.2.cjs

Finally use the import as below.

import {x} from "@vesato/libraryname"

For Gitlab I used:

npmScopes:
  "<namespace>":
    npmRegistryServer: "https://<server>/api/v4/packages/npm/"

npmRegistries:
  //<server>/api/v4/packages/npm:
    npmAlwaysAuth: true
    npmAuthToken: ${GITLAB_AUTH_TOKEN}

To allow committing the file, it's possible to store the authentication token in an environment variable.

The safe way for Yarn 4, with token stored in your user directory:

1. Add scope information to your package .yarnrc.yml

   npmScopes:
     your_scope:
       npmRegistryServer: "https://npm.pkg.github.com"
       npmAlwaysAuth: true
   

2. Execute

   yarn npm login --scope your_scope
   

your_scope in both cases is without @

To validate, check if there is ~/.yarnrc.yml with the token.