GitLab CI从私有npm仓库安装包时出现404错误求助

我在自建GitLab服务器上搭建了私有npm仓库，项目执行npm构建流程时，GitLab CI拉取私有npm包返回404错误，但直接访问该包的链接能正常打开。尝试过配置.npmrc的registry和token等多种方案，都没解决问题。相关CI配置代码及错误信息如下：

CI配置代码 #

image: node:16

variables:
  NPM_TOKEN: "TOKEN"
default:
  before_script:
    - apt update && apt upgrade -y
    - apt install -y jq
    - ln -sf python3 /usr/bin/python
    - apt install -y python3-pip
    - curl -Lo ./sops 'https://github.com/mozilla/sops/releases/download/v3.7.3/sops-v3.7.3.linux'
    - chmod +x ./sops
    - mv ./sops /usr/local/bin/
    - pip3 install awscli
    - aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID --profile stg
    - aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY --profile stg
    - aws configure set region $AWS_DEFAULT_REGION --profile stg
    - eval $(ssh-agent -s)
    - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
    - git config --global user.email $GITLAB_USER_EMAIL
    - git config --global user.name $GITLAB_USER_ID
    - git fetch
    - rm -f .npmrc
    - rm -f /root/.npmrc
    - rm -f ~/.npmrc
    - printenv NPM_TOKEN
    - echo '@e-comm:registry=https://<URL>:9500/api/v4/projects/99/packages/npm/' >>  ~/.npmrc
    - npm config set //stupidboy.browzwear.com/api/v4/projects/99/packages/npm/:_authToken ${NPM_TOKEN}


stages:
  - test
  - build
  # - deploy

test:
  stage: test
  script:
    - ls -la
    - sops -d ./api/mongo-atlas.stg.pem.enc > ./factory/mongo-atlas.stg.pem
    # - cp $NPMRC_CS_DATA ./factory/.npmrc
    # - cp $NPMRC_CS_DATA ./.npmrc
    - npm config ls -l
    - npm  --prefix ./factory --verbose install
    - npm --prefix ./factory test

错误信息 #

npm verb node v16.17.0
npm verb npm  v8.15.0
npm ERR! code E404
npm ERR! 404 Not Found - GET https://<URL>:9500/api/v4/projects/99/packages/npm/@e-comm%2fcs-client
npm ERR! 404 
npm ERR! 404  '@e-comm/cs-client@1.0.0' is not in this registry.
npm ERR! 404 
npm ERR! 404 Note that you can also install from a
npm ERR! 404 tarball, folder, http url, or git url.
npm verb exit 1

排查与解决步骤 #

• 修正.npmrc域名一致性：你配置的registry域名是<URL>:9500，但token对应的域名是stupidboy.browzwear.com，两者不匹配。必须保证registry地址和token前缀的域名（含端口）完全一致，修改token配置命令：

  npm config set //<URL>:9500/api/v4/projects/99/packages/npm/:_authToken ${NPM_TOKEN}
  

  或者直接写入.npmrc：

  echo '//<URL>:9500/api/v4/projects/99/packages/npm/:_authToken=${NPM_TOKEN}' >> ~/.npmrc
  

• 验证NPM_TOKEN权限：确保NPM_TOKEN是拥有项目ID 99权限的个人访问令牌（PAT），需勾选read_api和read_repository权限，可在GitLab个人设置中重新生成符合要求的令牌。

• 检查包名与版本正确性：确认package.json中@e-comm/cs-client的版本1.0.0确实存在于私有仓库，注意npm对包名大小写敏感，避免拼写错误。

• 确认.npmrc生效路径：执行npm install时用了--prefix ./factory，需确保factory目录下没有覆盖配置的.npmrc文件，如有则删除或合并配置。

• 测试registry访问：在CI的before_script中添加命令验证token有效性：

  curl --header "Authorization: Bearer ${NPM_TOKEN}" https://<URL>:9500/api/v4/projects/99/packages/npm/@e-comm/cs-client
  

  若返回包信息则token和权限正常；若仍404，检查项目ID、包名是否正确。

内容的提问来源于stack exchange，提问作者sdblepas