From 55ae58cd5e02541f8174d510a88361e792217a80 Mon Sep 17 00:00:00 2001 From: GitHub Copilot Date: Wed, 15 Apr 2026 04:40:56 +0000 Subject: [PATCH] docs: document private marketplace repo support (#701) apm marketplace add now uses credentials from the first request when probing marketplace.json, fixing silent failures on private repos. Add a dedicated section in the Marketplaces guide explaining the behavior and the credential resolution order. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- docs/src/content/docs/guides/marketplaces.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/docs/src/content/docs/guides/marketplaces.md b/docs/src/content/docs/guides/marketplaces.md index a2607822..a123c2fa 100644 --- a/docs/src/content/docs/guides/marketplaces.md +++ b/docs/src/content/docs/guides/marketplaces.md @@ -161,6 +161,21 @@ apm marketplace update acme-plugins apm marketplace update ``` +## Private marketplace repositories + +Private marketplace repositories work without extra configuration. APM uses the same credential resolution as `apm install`: `GITHUB_APM_PAT`, per-org `GITHUB_APM_PAT_{ORG}` env vars, and git credential helpers are all tried automatically before falling back to unauthenticated access. + +```bash +export GITHUB_APM_PAT=github_pat_your_token + +# Registers a private marketplace — credentials applied automatically +apm marketplace add your-org/private-marketplace +``` + +Previously, `apm marketplace add` would silently fail for private repos because the credential check happened after the initial probe. The fix ensures credentials are used from the first request, so 404s from auth failures are no longer confused with missing `marketplace.json` files. + +See [Authentication](../../getting-started/authentication/) for the full credential priority order. + ## Registry proxy support When `PROXY_REGISTRY_URL` is set, marketplace commands (`add`, `browse`, `search`, `update`) fetch `marketplace.json` through the registry proxy (Artifactory Archive Entry Download) before falling back to the GitHub Contents API. When `PROXY_REGISTRY_ONLY=1` is also set, the GitHub API fallback is blocked entirely, enabling fully air-gapped marketplace discovery.