Consume a package

Every Willdan package — private and public, npm, PyPI, Maven, NuGet, Swift, Ruby, Cargo and generic — comes from one CodeArtifact repository: domain willdan, repository willdan, in the devops account. Public registries (npmjs, pypi.org, Maven Central, nuget.org) are chained as upstreams, so the single index URL serves a private package and its public dependencies alike. You never add a second registry.

The owner is in the package name — the npm scope, the Maven groupId, the NuGet prefix — not in a repository of its own. Read authorization is per repository (ReadFromRepository), never per package.

The credential

Authentication is IAM: a 12-hour token from codeartifact get-authorization-token, which npm, pip and uv, Maven and NuGet all accept as a plain credential. There is no long-lived package secret to hold.

Two ways to get one, depending on what you have:

You have an AWS seat. aws sso login, then ask CodeArtifact for the token yourself:

Code
aws codeartifact get-authorization-token \
  --domain willdan --query authorizationToken --output text

You have only a Switchboard sign-in. The console's Packages → Connect a tool vends the same token: your session is exchanged through the OIDC path for a package-reader role scoped by your swb.packages.read grant, and CodeArtifact issues the token to that role. A private Python package then installs with plain uv add — no GitHub seat, no secret in your dotfiles.

Both paths end at the same 12-hour token against the same index URL. When it expires, ask again.

Wiring your toolchain

Packages → Connect a tool in the console prints the exact commands for your tool with the repository's own endpoint filled in. The AWS CLI also writes most of them for you:

Code
aws codeartifact login --tool npm --domain willdan --repository willdan
aws codeartifact login --tool pip --domain willdan --repository willdan

For uv, Maven and NuGet, take the index URL and the token from the same page and put them where that toolchain expects a registry credential.

Publishing

Publishing is the ordinary command for the toolchain, pointed at the same repository: npm publish, uv publish, mvn deploy, dotnet nuget push. In CI it runs from the shared publish workflow under the OIDC deploy role, which gets its token the same way. The schema service is just one more publisher on this repository — see resolved at build.

What is not here

CloudFormation templates and config-as-code bundles are not packages. They live in the artifact buckets, where a build's own row and the catalog are already the index over them.