Retrieve a Github Registry npm package from a Github Action - npm

Question

I have successfully deployed #myorganization/my-super-lib as a GH npm package. Now I would like to use it in an other GH project.
This is a private lib, and a private project (important to remember, as the point is moot with public ones).
Locally, no problem, just add the correct authtoken config with my personal token in my npm config.
Now, when using Github Actions, I am not sure what the elegant solution would be for a token to access the library package. The documentation says to use a personal one, but what if I leave the org? I could also use a dedicated technical account just for that, but that doesn't seem like the "right" solution.
Has anyone got a better idea?
Edit after comments: At first I thought that I could simply use the GITHUB_TOKEN, but it is restricted to access only the current repository, and this is logical from a security perspective after thinking about it.

Answer 1

There is currently no better option than using a personal access token, i.e.:
Create a personal read:packages access token from an account that has read access
Insert that token as "Secret" to the repository (where you execute the Github Actions)
Access the token via in the Secrets in the Github Actions Workflow to authenticate and install the dependency stored in the Github Registry

Answer 2

to use Github actions to install private github package you need also at
actions/setup-node#v1: define the scope of the package registry
npm install: use personal access token with read, repo access. This token should be created by any github account that has access to the private github package that you use and stored as secret to the repo that uses that action.
Note: the --ignore-scripts is an optional flag that adds extra protection against malicious scripts that can steal your personal access token
example:
steps:
- uses: actions/checkout#v2
- uses: actions/setup-node#v1
with:
node-version: '12.x'
registry-url: 'https://npm.pkg.github.com'
scope: '#antecha'
- run: npm install --ignore-scripts
env:
NODE_AUTH_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
UPDATE:
example repo: https://github.com/antecha/survey
Personal Access token as I mentioned can be created by ANY account that has access to the private registry. For orgs best is to create an admin-profile/account at github with only purpose to manage such tokens or/and org's github authentication to 3rd party apps.

Answer 3

I personaly use that script (.github/workflows/my-super-workflow-file.yml)
name: CI
on: [push]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout#v1
- name: Setup node
uses: actions/setup-node#v1
with:
node-version: '10.x'
registry-url: 'https://npm.pkg.github.com'
- run: npm install --ignore-scripts
env:
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- run: npm test