Installation

The packages are private and published to GitHub Packages under the @monk-business scope. Installing them needs a GitHub token with the read:packages scope, locally and in CI.

1. Point the scope at GitHub Packages

Add an .npmrc to the root of the consuming repository:

.npmrc

@monk-business:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}

The token is read from the NODE_AUTH_TOKEN environment variable, so the file can be committed: it contains no secret.

2. Get a token on your machine

With the GitHub CLI, add the read:packages scope to your login once and export the token in your shell:

gh auth refresh -s read:packages
export NODE_AUTH_TOKEN=$(gh auth token)

Put the export line in your shell profile, or run it before installing.

3. Install

pnpm add @monk-business/tokens @monk-business/brand @monk-business/css @monk-business/astro

Install only what you need: @monk-business/tokens is enough for colors and type in another stack; @monk-business/css needs the tokens; @monk-business/astro needs the CSS and the brand package (it inlines the logos from it).

Pin the same version for all four packages. They are released together and tested together.

4. Install in CI (GitHub Actions)

In the consuming repository’s workflow, give the job read access to packages and pass the built-in GITHUB_TOKEN as NODE_AUTH_TOKEN:

.github/workflows/ci.yml

permissions:
  contents: read
  packages: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v5
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

GITHUB_TOKEN can only read a private package when the package grants the repository access. Do this once per package (tokens, brand, css, astro):

1. Open the package on GitHub: the organization’s Packages tab, then the package.
2. Package settings → Manage Actions access → Add repository.
3. Choose the consuming repository (for example monk-business/website) with the Read role.

Without this step the install fails with 403 Forbidden even though the workflow has packages: read.

Troubleshooting

• 401 Unauthorized: NODE_AUTH_TOKEN is empty or the token lacks read:packages. Run the commands in step 2 again.
• 404 Not Found for @monk-business/...: the .npmrc scope line is missing, so pnpm asked the public npm registry.
• 403 Forbidden in Actions: the repository has not been granted access in the package settings (step 4).