No Public Registries + Package Registries Collector

✓ Guardrail ↓ Collector Stable Security And Compliance

Enforce No Public Registries using data collected by Package Registries Collector. Automatically check security and compliance standards on every PR.

Guardrail: Requires that no dependency resolves from a well-known public package index (npm, PyPI, Maven Central, RubyGems, NuGet). Needs no configuration — use it when every package must come through an internal registry or proxy.

Data Source: Record which package registries a repository resolves dependencies from — npm, pip, Maven, Gradle, RubyGems and NuGet. Reads explicit registry overrides and falls back to each ecosystem's public default, so implicit public-index use stays visible.

Get Started View on GitHub

How Package Registries Collector Powers This Guardrail

The Package Registries Collector gathers metadata from your build systems. This data flows into Lunar's Component JSON, where the No Public Registries guardrail evaluates it against your standards.

When enabled, this check runs automatically on every PR and in AI coding workflows, providing real-time enforcement with actionable feedback.

↓ Package Registries Collector Gathers Data Collector

Extracts metadata from code, configs, and tool outputs

{ } Component JSON

Data centralized in structured format for evaluation

✓ No Public Registries Checks Guardrail

Pass/fail result with actionable feedback in PRs

Quick Start Configuration

Add both the collector and policy to your lunar-config.yml to enable this guardrail.

📄 lunar-config.yml

# Step 1: Enable the Package Registries Collector
collectors:
  - uses: github://earthly/lunar-lib/collectors/package-registries@v1.0.5
    # with: ...

# Step 2: Enable the Dependency Guardrails
policies:
  - uses: github://earthly/lunar-lib/policies/dependencies@v1.0.5
    include: [no-public-registries]
    # with: ...

What Package Registries Collector Collects

This collector gathers the following data that the No Public Registries guardrail evaluates.

Collector code

`scan`

Finds package-manager configuration in the repository and records the registries each ecosystem resolves dependencies from:

npm: .npmrc (registry=, @scope:registry=)
pip: pip.conf / pip.ini, requirements*.txt (--index-url, --extra-index-url), pyproject.toml (Poetry / uv / PDM sources)
Maven: pom.xml (<repositories>, <pluginRepositories>, <distributionManagement>) and settings.xml (<mirrors>, <repositories>)
Gradle: build.gradle(.kts) / settings.gradle(.kts) (maven { url ... })
RubyGems: Gemfile (source)
NuGet: nuget.config (<packageSources>) When an ecosystem's manifest is present but declares no registry, the entry records that ecosystem's public default (for example registry.npmjs.org) with is_default: true, so a repository that silently resolves from a public index is still reported.

Example Data Flow

Here's an example of the data that Package Registries Collector writes to the Component JSON, which No Public Registries then evaluates.

{ } component.json From Package Registries Collector

{
  "dependencies": {
    "source": {
      "tool": "package-registries",
      "integration": "code"
    },
    "ecosystems": ["npm", "maven"],
    "registries": [
      {
        "ecosystem": "npm",
        "host": "dl.cloudsmith.io",
        "url": "https://dl.cloudsmith.io/basic/acme/npm/",
        "path": ".npmrc",
        "kind": "primary",
        "is_default": false,
        "is_public": false
      },
      {
        "ecosystem": "npm",
        "host": "registry.npmjs.org",
        "url": "https://registry.npmjs.org/",
        "path": ".npmrc",
        "name": "@acme",
        "kind": "primary",
        "is_default": false,
        "is_public": true
      },
      {
        "ecosystem": "maven",
        "host": "repo.maven.apache.org",
        "url": "https://repo.maven.apache.org/maven2",
        "path": "pom.xml",
        "name": "central",
        "kind": "primary",
        "is_default": true,
        "is_public": true
      }
    ],
    "registries_used": ["dl.cloudsmith.io", "registry.npmjs.org", "repo.maven.apache.org"],
    "summary": {
      "has_public": true
    }
  }
}

Configuration Options

Package Registries Collector Inputs

Input	Required	Default	Description
`find_command`	Optional	`find . -type f \( -name '.npmrc' -o -name 'package.json' -o -name 'pip.conf' -o -name 'pip.ini' -o -name 'requirements.txt' -o -name 'pyproject.toml' -o -name 'pom.xml' -o -name 'settings.xml' -o -name 'build.gradle' -o -name 'build.gradle.kts' -o -name 'settings.gradle' -o -name 'settings.gradle.kts' -o -name 'Gemfile' -o -name 'packages.config' -o -name '.csproj' -o -iname 'nuget.config' \) -not -path '/node_modules/' -not -path '/.git/'`	Command to find package-manager config and manifest files (must output one file path per line)
`ecosystems`	Required	—	Comma-separated ecosystems to scan (npm, pip, maven, gradle, rubygems, nuget). Empty scans all.

Dependency Guardrails Inputs

Input	Required	Default	Description
`language`	Required	—	Programming language to check (e.g., "go", "java", "python", "nodejs")
`min_versions`	Optional	`{}`	JSON object mapping dependency paths to minimum safe versions (e.g., {"github.com/example/lib": "1.0.0"})
`include_indirect`	Optional	`false`	Whether to also check indirect (transitive) dependencies
`allowed_registries`	Required	—	Comma-separated list of allowed package registry hosts (e.g. "dl.cloudsmith.io")

Learn More

Guardrail · Dependency Guardrails No Public Registries View all compatible integrations

→

Collector Package Registries Collector View full documentation

→

Ready to Automate Your Standards?

See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 200+ built-in guardrails.

Works with any process

AI agent rules & prompt files

Post-mortem action items

Security & compliance policies

Testing & quality requirements

Automate Now

Paste your AGENTS.md or manual process doc and get guardrails in minutes

Book a Demo