GitHub Actions · npm · Checked November 4, 2026

npm 12 in GitHub Actions: "EALLOWGIT" and blocked install scripts

npm 12 changed two defaults that a CI install depends on (12.0.0 release notes). Dependencies that point to a git repository or a tarball URL are no longer fetched (allow-git and allow-remote default to none), and the install scripts of dependencies do not run unless allowScripts in your package.json lists them. On a laptop that is a prompt to review. In a workflow it is either an error or a step that passes and leaves something out.

How npm 12 gets into a job

• npm install -g npm@latest. The registry's latest is npm 12 (12.2.1 on November 4). Publish workflows often have this line because trusted publishing needs npm 11.5.1 or later; npm install -g npm@11 meets that and stays on npm 11.
• node-version: latest in actions/setup-node. At the end of October it began to resolve to the Node.js 27 alpha, which comes with npm 12.1.0 (runner-images #15193; setup-node #1657 asks for an option for that). node-version: lts/* or '26' gives Node.js 26 with npm 11.20.0.

A npm --version step shows which one the job got.

1. "EALLOWGIT"

npm error code EALLOWGIT
npm error Fetching packages of type "git" have been disabled
npm error Refusing to fetch "hexo-next-fallback@github:wherewhere/hexo-next-fallback"

A dependency given as github:owner/repo, a git URL or a GitHub URL was refused. Allow it in an .npmrc at the root of the repository:

allow-git=root

root allows the git dependencies your own package.json names; all also allows git dependencies deeper in the tree (allow-git in npm's config definitions). For one command, npm ci --allow-git=root. Dependencies given as a tarball URL have the same setting, allow-remote, with the same values.

2. Install scripts blocked

npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:
npm warn install-scripts   better-sqlite3@12.11.1 (install: prebuild-install || node-gyp rebuild --release)
npm warn install-scripts
npm warn install-scripts Run `npm install-scripts ls` to review, or `npm install-scripts approve <pkg>` to allow.

The install itself succeeds. The failure comes later, from whatever the script would have made: better-sqlite3 had no native binding and stopped with "Could not locate the bindings file" (MultiWikiServer #141), and a package that fetches its own binary in postinstall was installed without it (gentle-shell #2730). Scripts in your own package.json still run; only those of dependencies are blocked.

Decide once, in the repository. With npm 12 on your machine:

npm install-scripts ls
npm install-scripts approve better-sqlite3

approve writes the entry into allowScripts in package.json. Commit it, and npm ci in the workflow follows it. azure-mud allows each package at the version it reviewed and denies one (azure-mud #1083):

"allowScripts": {
  "core-js": false,
  "@parcel/watcher@2.6.0": true,
  "@swc/core@1.16.20": true
}

• By default approve pins the version you reviewed, so an update to that dependency is blocked again until you approve the new version. --no-allow-scripts-pin writes the name only, which allows any future version (npm install-scripts).
• --allow-scripts on the command line of a project's npm install or npm ci is an error. It is for npm install -g, npx and npm exec, for example npm install -g --allow-scripts=sharp sharp.
• Recent npm 11 releases print "not yet covered by allowScripts" and still run the scripts. Adding allowScripts now makes npm 11 and 12 install the same tree (#1083).

3. Or stay on npm 11 for now

- run: npm install -g npm@11
- run: npm ci

npm 11 still gets releases (11.21.1 came out on October 15, the same day as 12.2.1), and it is new enough for trusted publishing. This only puts off the decision: the allowScripts entries are the same work later.

Other npm 12 changes that show up in workflows

From the same release notes:

• Unknown flags, abbreviated flags and single-hyphen multi-letter flags are errors, not warnings.
• npm-shrinkwrap.json is no longer read, and npm shrinkwrap and npm adduser are gone.
• npm view --json always returns an array, and the --json output of npm pack and npm publish changed. A script that reads a value from them may need to change.

Telling it apart

• "ENEEDAUTH" or "404 Not Found - PUT" on npm publish: npm reached the registry without a valid login.
• "git@github.com: Permission denied (publickey)" after an ls-remote of your own path: npm read a tarball path as a GitHub repository.
• "Could not locate the bindings file" with npm 10 or 11: the script ran and the build of the native module failed. The step's log above it says why.

See failed jobs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

GitHub and GitHub Actions are trademarks of GitHub, Inc.; npm is a trademark of npm, Inc.; Node.js is a trademark of the OpenJS Foundation; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc., npm, Inc., the OpenJS Foundation or JetBrains.

More: npm publish and "ENEEDAUTH" · npm publish and "Permission denied (publickey)" · "Node.js 20 actions are deprecated" · GitHub Actions plugins for IntelliJ IDEA compared · 日本語