Skip to content

[docs] Update documentation for features from 2026-04-15 #716

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
danielmeppiel wants to merge 1 commit into
base: main
Choose a base branch
from
+15 −0
Open

[docs] Update documentation for features from 2026-04-15 #716

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions docs/src/content/docs/guides/marketplaces.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,21 @@ apm marketplace update acme-plugins
apm marketplace update
```

## Private marketplace repositories

Private marketplace repositories work without extra configuration. APM uses the same credential resolution as `apm install`: `GITHUB_APM_PAT`, per-org `GITHUB_APM_PAT_{ORG}` env vars, and git credential helpers are all tried automatically before falling back to unauthenticated access.
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This sentence claims credentials are tried “before falling back to unauthenticated access,” which can be read as always attempting an unauthenticated request eventually. Since the PR description emphasizes the fix is to avoid an unauthenticated first probe (to prevent 404 confusion), consider rewording to clarify the order for private repos (e.g., credentials are applied on the initial probe/request). This makes the doc consistent with the behavior change being documented.

Suggested change
Private marketplace repositories work without extra configuration. APM uses the same credential resolution as `apm install`: `GITHUB_APM_PAT`, per-org `GITHUB_APM_PAT_{ORG}` env vars, and git credential helpers are all tried automatically before falling back to unauthenticated access.
Private marketplace repositories work without extra configuration. APM uses the same credential resolution as `apm install`: `GITHUB_APM_PAT`, per-org `GITHUB_APM_PAT_{ORG}` env vars, and git credential helpers are resolved automatically and applied on the initial request for private repositories.

Copilot uses AI. Check for mistakes.

```bash
export GITHUB_APM_PAT=github_pat_your_token
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Even though this is an example token, showing a PAT-shaped value in docs increases the chance users paste real secrets into terminals, logs, or screenshots. Prefer a clearly non-token placeholder (e.g., export GITHUB_APM_PAT=\"<your_token>\") and consider adding a brief note like “do not commit or share this value.”

Suggested change
export GITHUB_APM_PAT=github_pat_your_token
export GITHUB_APM_PAT="<your_token>"
# Do not commit or share this value.

Copilot uses AI. Check for mistakes.

# Registers a private marketplace — credentials applied automatically
apm marketplace add your-org/private-marketplace
```

Previously, `apm marketplace add` would silently fail for private repos because the credential check happened after the initial probe. The fix ensures credentials are used from the first request, so 404s from auth failures are no longer confused with missing `marketplace.json` files.

See [Authentication](../../getting-started/authentication/) for the full credential priority order.

## Registry proxy support

When `PROXY_REGISTRY_URL` is set, marketplace commands (`add`, `browse`, `search`, `update`) fetch `marketplace.json` through the registry proxy (Artifactory Archive Entry Download) before falling back to the GitHub Contents API. When `PROXY_REGISTRY_ONLY=1` is also set, the GitHub API fallback is blocked entirely, enabling fully air-gapped marketplace discovery.
Expand Down
Loading