Package Registries Collector

↓ Collector Beta Build

Record which package registries a repository resolves dependencies from — npm, pip, Maven, Gradle, RubyGems and NuGet. Reads explicit registry overrides and falls back to each ecosystem's public default, so implicit public-index use stays visible.

Add package-registries to your lunar-config.yml:

uses: github://earthly/lunar-lib/collectors/package-registries@v1.0.5

Get Started View on GitHub

What This Integration Collects

This integration includes 1 collector that gather metadata from your systems.

Collector code

`scan`

Finds package-manager configuration in the repository and records the registries each ecosystem resolves dependencies from:

npm: .npmrc (registry=, @scope:registry=)
pip: pip.conf / pip.ini, requirements*.txt (--index-url, --extra-index-url), pyproject.toml (Poetry / uv / PDM sources)
Maven: pom.xml (<repositories>, <pluginRepositories>, <distributionManagement>) and settings.xml (<mirrors>, <repositories>)
Gradle: build.gradle(.kts) / settings.gradle(.kts) (maven { url ... })
RubyGems: Gemfile (source)
NuGet: nuget.config (<packageSources>) When an ecosystem's manifest is present but declares no registry, the entry records that ecosystem's public default (for example registry.npmjs.org) with is_default: true, so a repository that silently resolves from a public index is still reported.

package registry npmrc index-url pip.conf maven repositories settings.xml nuget.config gemfile source artifact repository registry provenance approved registry supply chain cloudsmith artifactory nexus

Book a demo

How Collectors Fit into Lunar

Lunar watches your code and CI/CD systems to collect SDLC data from config files, test results, IaC, deployment configurations, security scans, and more.

Collectors are the automatic data-gathering layer. They extract structured metadata from your repositories and pipelines, feeding it into Lunar's centralized database where guardrails evaluate it to enforce your engineering standards.

Learn How Lunar Works →

↓ Collectors Gather Data This Integration

Triggered by code changes or CI pipelines, collectors extract metadata from config files, tool outputs, test results, and scans

{ } Centralized as JSON

All data merged into each component's unified metadata document

✓ Guardrails Enforce Standards

Real-time feedback in PRs and AI workflows

Example Collected Data

This collector writes structured metadata to the Component JSON. Here's an example of the data it produces:

{ } component.json Component JSON

{
  "dependencies": {
    "source": {
      "tool": "package-registries",
      "integration": "code"
    },
    "ecosystems": ["npm", "maven"],
    "registries": [
      {
        "ecosystem": "npm",
        "host": "dl.cloudsmith.io",
        "url": "https://dl.cloudsmith.io/basic/acme/npm/",
        "path": ".npmrc",
        "kind": "primary",
        "is_default": false,
        "is_public": false
      },
      {
        "ecosystem": "npm",
        "host": "registry.npmjs.org",
        "url": "https://registry.npmjs.org/",
        "path": ".npmrc",
        "name": "@acme",
        "kind": "primary",
        "is_default": false,
        "is_public": true
      },
      {
        "ecosystem": "maven",
        "host": "repo.maven.apache.org",
        "url": "https://repo.maven.apache.org/maven2",
        "path": "pom.xml",
        "name": "central",
        "kind": "primary",
        "is_default": true,
        "is_public": true
      }
    ],
    "registries_used": ["dl.cloudsmith.io", "registry.npmjs.org", "repo.maven.apache.org"],
    "summary": {
      "has_public": true
    }
  }
}

Configuration

Configure this collector in your lunar-config.yml.

Inputs

Input	Required	Default	Description
`find_command`	Optional	`find . -type f \( -name '.npmrc' -o -name 'package.json' -o -name 'pip.conf' -o -name 'pip.ini' -o -name 'requirements.txt' -o -name 'pyproject.toml' -o -name 'pom.xml' -o -name 'settings.xml' -o -name 'build.gradle' -o -name 'build.gradle.kts' -o -name 'settings.gradle' -o -name 'settings.gradle.kts' -o -name 'Gemfile' -o -name 'packages.config' -o -name '.csproj' -o -iname 'nuget.config' \) -not -path '/node_modules/' -not -path '/.git/'`	Command to find package-manager config and manifest files (must output one file path per line)
`ecosystems`	Required	—	Comma-separated ecosystems to scan (npm, pip, maven, gradle, rubygems, nuget). Empty scans all.

Documentation

View on GitHub

Package Registries Collector

Records which package registries a repository resolves its dependencies from, across npm, pip, Maven, Gradle, RubyGems and NuGet.

Overview

This collector reads package-manager configuration that is already committed to the repository and normalizes the registry hosts each ecosystem resolves dependencies from. It runs as a code collector on the Lunar runner and needs no registry credentials or API token. When an ecosystem's manifest is present but declares no registry, the collector records that ecosystem's public default instead of staying silent, so a repository that implicitly pulls from a public index is still visible to guardrails.

Collected Data

This collector writes to the following Component JSON paths:

Path	Type	Description
`.dependencies.source`	object	Tool metadata (`tool`, `integration`)
`.dependencies.ecosystems[]`	array	Package ecosystems detected in the repository
`.dependencies.registries[]`	array	One entry per registry declaration found
`.dependencies.registries[].ecosystem`	string	`npm`, `pip`, `maven`, `gradle`, `rubygems` or `nuget`
`.dependencies.registries[].host`	string	Registry hostname — what allowlists are matched against
`.dependencies.registries[].url`	string	Registry URL as declared (or the ecosystem default)
`.dependencies.registries[].path`	string	File the declaration was read from
`.dependencies.registries[].name`	string	Declaration identifier where one exists (npm scope, Maven repo id, NuGet source key)
`.dependencies.registries[].kind`	string	Role of the declaration: `primary`, `extra`, `mirror`, `plugin` or `publish`
`.dependencies.registries[].is_default`	boolean	`true` when no registry was declared and the ecosystem's public default applies
`.dependencies.registries[].is_public`	boolean	`true` when the host is a well-known public package index
`.dependencies.registries_used[]`	array	Deduplicated registry hostnames across all ecosystems
`.dependencies.summary.has_public`	boolean	`true` when any resolved registry is a public index

Repositories with no package-manager configuration and no recognized manifest produce no .dependencies object at all, so guardrails that read it skip cleanly.

Implicit defaults are recorded

A repository with a package.json but no .npmrc resolves from registry.npmjs.org. Rather than reporting nothing, the collector records that default with is_default: true. This is what lets an approved-registry guardrail catch the most common case — a project that was never pointed at the internal registry in the first place — and it means the guardrail cannot be satisfied by deleting a config file.

Registry hosts, not credentials

Only the registry location is collected. Auth tokens in .npmrc, settings.xml or nuget.config are never read or written to Component JSON.

Configured, not resolved

This collector reports which registry a repository is configured to resolve from. It does not verify where each installed package actually came from — a repository whose .npmrc points at an internal registry can still have a package-lock.json full of packages resolved from registry.npmjs.org, if the lockfile predates the config change. Lockfiles do record that per package (npm and yarn resolved URLs, Gemfile.lock remote:), so per-dependency provenance is a viable follow-up, but Maven, Gradle and NuGet lockfiles don't record a source repository, so it cannot replace this config-level check.

Not covered

Container image registries are collected by the docker collector and enforced by the container guardrails' allowed-registries check. Helm chart repositories are collected by the helm collector. Go resolves through the GOPROXY environment variable rather than a committed file, and Cargo's .cargo/config.toml is not yet parsed.

Collectors

This integration provides the following collectors (use include to select a subset):

Collector	Description
`scan`	Parses package-manager config and manifests, and records the resolved registries

Installation

Add to your lunar-config.yml:

collectors:
  - uses: github://earthly/lunar-lib/collectors/package-registries@v1.0.0
    on: ["domain:your-domain"]  # Or use tags like [backend, node]
    # with:
    #   ecosystems: "npm,maven"   # Restrict to specific ecosystems

Pair it with the dependencies guardrails to enforce an approved registry allowlist:

policies:
  - uses: github://earthly/lunar-lib/policies/dependencies@v1.0.0
    include: [approved-registries]
    on: ["domain:your-domain"]
    with:
      allowed_registries: "dl.cloudsmith.io"

Open Source

This collector is open source and available on GitHub. Contribute improvements, report issues, or fork it for your own use.

View Repository

Common Use Cases

Explore guardrails that use data from Package Registries Collector.

Min Versions + Package Registries Collector Ensures dependencies meet minimum safe version requirements. Validates that...

→

Approved Registries + Package Registries Collector Restricts dependency resolution to an approved list of package...

→

No Public Registries + Package Registries Collector Requires that no dependency resolves from a well-known public package...

→

Ready to Automate Your Standards?

See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 200+ built-in guardrails.

Works with any process

AI agent rules & prompt files

Post-mortem action items

Security & compliance policies

Testing & quality requirements

Automate Now

Paste your AGENTS.md or manual process doc and get guardrails in minutes

Book a Demo

Package Registries Collector

What This Integration Collects

scan

How Collectors Fit into Lunar

Example Collected Data

Configuration

Inputs

Related

Documentation

Package Registries Collector

Overview

Collected Data

Implicit defaults are recorded

Registry hosts, not credentials

Configured, not resolved

Not covered

Collectors

Installation

Open Source

Common Use Cases

Ready to Automate Your Standards?

`scan`