npm ci fails with 403 Forbidden on GitHub Actions

[stoprocent]

Description:
Since a couple of hours ago, my GitHub Actions workflow started failing during the npm ci step on Ubuntu runners. The same setup was working previously, and locally everything still installs fine. The error is:

npm error code E403
npm error 403 Forbidden - GET https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz

Even though I’ve configured registry-url: https://npm.pkg.github.com, it still tries to fetch from registry.npmjs.org. I’ve attempted overriding the registry URL manually too, but it didn't help. Am I missing something?

Action version:
actions/setup-node@v4

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Tools version:

• Node: 22.x
• npm: default bundled with Node 22.x (npm@10.x)

Repro steps:

1. Push any commit to main or open a PR on [stoprocent/bleno](https://github.com/stoprocent/bleno/actions)
2. Ubuntu job runs npm ci
3. Fails with E403 when fetching a public package (camelcase)

Expected behavior:
npm ci should complete successfully using either npmjs or GitHub registry (depending on package source)

Actual behavior:
npm ci fails with a 403 Forbidden from registry.npmjs.org, despite registry-url being set to https://npm.pkg.github.com.

Error log:

npm warn deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm warn deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm warn deprecated rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported
npm warn deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm error code E403
npm error 403 403 Forbidden - GET https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz
npm error 403 In most cases, you or one of your dependencies are requesting
npm error 403 a package version that is forbidden by your security policy, or
npm error 403 on a server you do not have access to.
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2025-04-01T16_37_13_503Z-debug-0.log
Error: Process completed with exit code 1.

Thanks in advance for any insights or help!

[stoprocent]

Found the reason ... npm/cli#8203