| 1 | --- |
| 2 | title: Packages |
| 3 | description: Publish and install packages beside your code, with the same people, roles and tokens. |
| 4 | --- |
| 5 | |
| 6 | A workspace can publish packages to g1t and install them from it, beside |
| 7 | the code they are built from: container images, npm packages, Rust |
| 8 | crates, Maven artifacts, NuGet packages, Ruby gems, Composer packages and |
| 9 | Go modules. Each registry speaks its tool's own protocol, so `docker`, |
| 10 | `npm`, `cargo`, `mvn` and Gradle, `dotnet`, `gem` and Bundler, `composer` |
| 11 | and `go` work with nothing but a login and an address. Composer packages and Go modules are |
| 12 | read from the workspace's repositories: there is nothing to upload. |
| 13 | |
| 14 | | Registry | Address | Guide | |
| 15 | | --- | --- | --- | |
| 16 | | Container images | `g1t.sh/<workspace>/<name>` | [Container images](/guides/containers/) | |
| 17 | | npm | `https://g1t.sh/-/npm/`, for the scope `@<workspace>` | [npm](/guides/npm/) | |
| 18 | | Cargo | `sparse+https://g1t.sh/-/cargo/<workspace>/index/`, a registry per workspace | [Cargo](/guides/cargo/) | |
| 19 | | Maven | `https://g1t.sh/-/maven/<workspace>/`, a repository per workspace, for Maven and Gradle | [Maven](/guides/maven/) | |
| 20 | | NuGet | `https://g1t.sh/-/nuget/<workspace>/v3/index.json`, a feed per workspace, with a symbol server | [NuGet](/guides/nuget/) | |
| 21 | | RubyGems | `https://g1t.sh/-/rubygems/<workspace>/`, a registry per workspace, for `gem push`, `gem install` and Bundler | [RubyGems](/guides/rubygems/) | |
| 22 | | Composer | `https://g1t.sh/-/composer/<workspace>/`, from the workspace's repositories | [Composer](/guides/composer/) | |
| 23 | | Go | `g1t.sh/<workspace>/<repo>`, straight from git | [Go modules](/guides/go/) | |
| 24 | |
| 25 | ## Names |
| 26 | |
| 27 | Every package's name starts with its workspace: `g1t.sh/acme/web` is the |
| 28 | `web` image of the `acme` workspace. A name may have more parts after it, |
| 29 | such as `g1t.sh/acme/web/worker`. |
| 30 | |
| 31 | ## Who can see and publish a package |
| 32 | |
| 33 | A package is linked to a repository, or belongs to its workspace. |
| 34 | |
| 35 | - **Linked.** The first push of an image whose name starts with a |
| 36 | repository's name (`acme/web`, `acme/web/worker` for the repository |
| 37 | `acme/web`) links it to that repository; so does the first publish of |
| 38 | an npm package whose `package.json` `repository` is a g1t.sh repository |
| 39 | of the workspace, or which is named like one (`@acme/web`), and of a |
| 40 | crate whose `Cargo.toml` `repository` is one, or which is named like |
| 41 | one. Maven artifacts (by artifactId, or the POM's `<scm><url>`), NuGet |
| 42 | packages (by `RepositoryUrl`, or their id) and gems (by |
| 43 | `source_code_uri`, or their name) are linked the same way. It then has the repository's visibility and [roles](/guides/access-and-roles/): |
| 44 | |
| 45 | | | Needs | |
| 46 | | --- | --- | |
| 47 | | Pull | Read: on a public repository, anyone, signed in or not | |
| 48 | | Push a new version or tag | Write | |
| 49 | | Delete versions and the package, change its settings | Admin | |
| 50 | |
| 51 | - **Unlinked.** A package whose name matches no repository is the |
| 52 | workspace's. It is private: members pull and push it by the workspace's |
| 53 | [base permission](/guides/access-and-roles/#the-base-permission) (Read pulls, |
| 54 | Write pushes), and only owners delete it or change its settings. An owner |
| 55 | can make it public, and then anyone can pull it. |
| 56 | |
| 57 | A linked package can be unlinked, and an unlinked one linked to a |
| 58 | repository of its workspace by someone with Admin on that repository. |
| 59 | |
| 60 | Private packages look exactly like ones that do not exist to anyone who may |
| 61 | not pull them. |
| 62 | |
| 63 | ## Tokens |
| 64 | |
| 65 | Sign in to a registry with your username and an |
| 66 | [access token](/guides/authentication/#access-tokens) as the password. |
| 67 | A token with scopes needs the package ones: |
| 68 | |
| 69 | | Scope | Lets a token | |
| 70 | | --- | --- | |
| 71 | | `packages:read` | Pull private packages. Public ones need no scope. | |
| 72 | | `packages:write` | Push and publish. Includes `packages:read`. | |
| 73 | | `packages:delete` | Delete versions and packages | |
| 74 | |
| 75 | Tokens with full access, and tokens made before scopes, have all three. A |
| 76 | token never does more than its owner could: `packages:delete` alone does not |
| 77 | let a member delete an owner's package. |
| 78 | |
| 79 | In [workflows](/guides/actions/#secrets-and-variables), `G1T_TOKEN` is the |
| 80 | workspace's own token for the run: it pushes and pulls the workspace's |
| 81 | packages with no setup. A g1t agent at work on a repository may push the |
| 82 | packages of that repository, as it may push its code, and never deletes |
| 83 | them. |
| 84 | |
| 85 | ## Storage |
| 86 | |
| 87 | Every file is kept once, by its content: two images that share a layer |
| 88 | store it once, and a layer pushed again is not stored again. A workspace's |
| 89 | storage counts each file once, as public when any public package uses it. |
| 90 | |
| 91 | Files no version uses any more are deleted a day after the last version |
| 92 | that used them goes. |
| 93 | |
| 94 | Without the [g1t plan](/guides/usage-and-billing/#the-g1t-plan), public |
| 95 | packages may hold 10 GB and private ones 500 MB per workspace; a push past |
| 96 | either is refused, with a message saying how much is used. On the plan, |
| 97 | storage past those amounts is charged instead. See |
| 98 | [storage and pull limits](/guides/containers/#storage-and-pull-limits). |
| 99 | |
| 100 | ## Events and the audit log |
| 101 | |
| 102 | Publishing a version, deleting a version and deleting a package are |
| 103 | [audit log](/guides/audit-log/) entries (so are deprecating an npm version, |
| 104 | yanking or unyanking a crate version, unlisting or listing a NuGet version, |
| 105 | pushing a NuGet version's symbols and yanking a gem version), and the events |
| 106 | `package.published`, `package.version_deleted`, `package.deleted` and |
| 107 | `package.visibility_changed`, which [webhooks](/guides/webhooks/) can be |
| 108 | sent: a linked package's go to its repository's webhooks and its |
| 109 | workspace's, an unlinked package's to its workspace's webhooks. |