Bugfix: How to fix npm 403 Forbidden errors during yarn install on G...

Documentation for Sessions

🐛 Bugfix: How to fix npm 403 Forbidden errors during yarn install on G...

Date: 2026-02-25
Time: 21:35:28 UTC
Session: gspace1-142.3
Agent: orchestrator
Confidence: 95%
Status: ✅ Documented

📋 Decision Context

Question:

How to fix npm 403 Forbidden errors during yarn install on GitHub Actions (Windows/Linux)?

Task: Fix Vitto Desktop CI/CD release workflow

🎯 Decision Made

Chosen:

Remove registry-url: 'https://registry.npmjs.org' and NODE_AUTH_TOKEN: $GITHUB_TOKEN from setup-node. Also remove packages: read permission. Add a 3-attempt retry loop with 15s backoff for intermittent CDN failures.

Options Considered:

  1. Remove registry-url + NODE_AUTH_TOKEN (fix auth poisoning)
  2. Add retry loop for transient CDN failures
  3. Switch to npm ci instead of yarn install
  4. Use npm registry mirror/proxy
  5. Add resolutions to force newer tr46 version

💭 Reasoning

Two root causes: (1) registry-url + NODE_AUTH_TOKEN=$GITHUB_TOKEN causes npm to authenticate to npmjs.org with a GitHub token, which npmjs.org rejects with 403 — this project uses ONLY the public registry with no private packages. (2) Even after removing auth, GitHub Actions runners share IPs and hit transient 403 rate limits from npm CDN (especially for old packages like [email protected]). The retry loop handles case 2. Previous 'fix' of ADDING registry-url was wrong and was the actual cause of case 1.

📁 Files Involved

🔗 Related

Auto-generated by MCP Smart Consolidation