Integrations

LPM.dev Registry connects package access, publishing automation, encrypted environments, and deployment platforms. Each integration uses its own credential and authorization boundary.

NeedIntegrationStart here
Install private or entitled packages in CIA read-scoped LPM_TOKEN supplied to LPM CLI or an npm-compatible clientCI/CD
Publish from GitHub Actions or GitLab CIA per-package Trusted Publisher that exchanges workload identity for short-lived publish accessTrusted Publishers
Decrypt an environment in CIAn env-specific OIDC policy and escrowed wrapping keyOIDC for CI
Synchronize application environmentsDirect LPM CLI connections to Vercel, Coolify, Fly.io, Railway, or GitHub ActionsPlatform Integrations
Install private packages during deploymentA read-scoped build credential or Docker BuildKit secretDeployment Platforms
Receive organization or personal eventsAn HTTPS endpoint that verifies the version 2 HMAC envelopeOutbound Webhooks

Package Access in CI

LPM CLI reads LPM_TOKEN directly:

npm install -g @lpm-registry/cli
lpm ci

If the project installs through npm, pnpm, or yarn, generate the job-local registry configuration first:

lpm setup ci npmrc
npm ci

Create a read-scoped token from personal or organization token settings. Store it in the CI provider's encrypted secret store.

Expose the token only to steps that need Registry access.

Trusted Publishing

Trusted Publishers remove the long-lived publish secret from GitHub Actions and GitLab CI.

Configure these values on the package's Trusted Publishers page:

  • The repository owner and name.
  • The immutable numeric repository ID or GitLab project ID.
  • The workflow file.
  • One exact branch or tag ref.
  • The optional environment.

Then run:

lpm publish -y

LPM CLI exchanges the job identity for a short-lived token restricted to that package.

Trusted Publisher authorization is separate from package-install credentials, env OIDC policies, and Sigstore provenance.

Legacy configurations without the numeric ID and exact ref cannot publish. Remove each disabled configuration and create it again.

Encrypted Environments

Env OIDC access is configured for each env:

lpm env oidc allow --provider=github --repo=owner/repository \
	--workflow=.github/workflows/deploy.yml --branch=main --env=production
lpm env pull --oidc --env=production --output=.env

This personal Pro workflow does not grant package publish access. See OIDC for CI for its policy, escrow, and provider requirements.

Platform Environment Sync

LPM CLI can synchronize selected environment values directly with:

  • Vercel
  • Coolify
  • Fly.io
  • Railway
  • GitHub Actions

Platform credentials and connection settings are managed separately from Registry package tokens. See Platform Integrations for supported operations and security boundaries.

See Also