Firebase App Hosting build fails to install private GitHub package despite valid NPM token and .npmrc setup

[asanobm]

[REQUIRED] Environment info

firebase-tools:
13.10.1

Platform:
macOS (M1 Max, Node.js v22.x)

---

[REQUIRED] Test case

I'm trying to deploy a Next.js 15 project to Firebase App Hosting, and this project depends on a private GitHub package published to GitHub Packages (e.g., @xxxxxxxxxx/xxxxxx).

To install the private package during build, I created a Firebase secret called npm-token and configured my apphosting.yaml like this:

env:
  - variable: NPM_TOKEN
    secret: npm-token
    availability:
      - BUILD

I also added a custom buildCommand to generate .npmrc dynamically:

scripts:
  buildCommand: |
    echo "@xxxxxxxxxx:registry=https://npm.pkg.github.com" > .npmrc
    echo "//npm.pkg.github.com/:_authToken=${NPM_TOKEN}" >> .npmrc
    echo "always-auth=true" >> .npmrc
    cp .npmrc $HOME/.npmrc
    cat $HOME/.npmrc || echo "no .npmrc"
    npm config list
    npm ci
    npm run build

This setup works perfectly on my local machine. However, the same configuration fails when building via Firebase App Hosting.

---

[REQUIRED] Steps to reproduce

1. Create a Next.js 15 project with a private GitHub dependency (e.g., @ xxxxxxxxxx/xxxxx).
2. Add a valid npm-token secret to Firebase.
3. Add the .npmrc creation logic and env config to apphosting.yaml.
4. Run firebase deploy to trigger a build on App Hosting.

---

[REQUIRED] Expected behavior

Firebase App Hosting should install the private GitHub package using the configured .npmrc and token from the secret manager without any issues—just like it works locally.

---

[REQUIRED] Actual behavior

The build fails with the following error:

Module not found: Can't resolve '@xxxxxxxxxx/xxxxx'

Despite all environment variables and .npmrc logic being properly set, Firebase App Hosting appears to either ignore .npmrc, misinterpret the token, or has a network/auth-related limitation during build.

---

Additional Notes

• The token used is a classic GitHub PAT with read:packages and repo scope.
• Locally, the .npmrc logic and the same token install the package without any issue.
• I've also tried manually authenticating with .npmrc variations, but the result is the same in App Hosting.
• There's no clear documentation or example for installing private GitHub packages using App Hosting + secret manager.

---

Request

Please confirm if:

1. Firebase App Hosting supports private GitHub package installs via .npmrc.
2. There's an undocumented limitation or workaround required.
3. App Hosting intentionally blocks access to external private package registries during build.

If this is a bug or documentation gap, a fix or clarification would be greatly appreciated.

[jhuleatt]

Hi @asanobm, the buildCommand is called after npm install, which is why it's failing. Private packages should work if you:

1. Set your private registry URL and npm token in Cloud Secret Manager with firebase apphosting:secrets:set.
2. Reference those values as environment variables in your .npmrc.
3. Include your .npmrc with your source when you firebase deploy instead of generating it in the buildCommand.