Changelog

GitHub registries now work with private repositories.

In June, we made it possible to turn any public GitHub repository into a registry. Teams asked for the same thing for their internal code: design systems, feature kits, agent rules, and conventions that should not be public.

You can now install from private repositories. If you can read the repository, the CLI can install from it.

pnpm dlx shadcn-svelte@latest add acme/internal-toolkit/auth-kit

npx shadcn-svelte@latest add acme/internal-toolkit/auth-kit

npx shadcn-svelte@latest add acme/internal-toolkit/auth-kit

bun x shadcn-svelte@latest add acme/internal-toolkit/auth-kit

Zero configuration #

If you are logged in to the GitHub CLI, there is nothing to set up.

gh auth login

When a repository is not publicly readable, the CLI reads it through gh using your stored credentials. The token stays inside the GitHub CLI. It never enters the shadcn-svelte process.

Using gh credentials.
Checking registry.
Created 1 file:
  - lib/auth.ts

CI support #

Where the GitHub CLI is not installed, set GH_TOKEN or GITHUB_TOKEN:

GH_TOKEN=github_pat_xxx npx shadcn-svelte@latest add acme/internal-toolkit/auth-kit

We recommend a fine-grained personal access token scoped to the repository with Contents: Read-only access.

Works with every command #

Private repositories work with the same commands as public GitHub registries.

pnpm dlx shadcn-svelte@latest add acme/internal-toolkit/auth-kit

npx shadcn-svelte@latest add acme/internal-toolkit/auth-kit

npx shadcn-svelte@latest add acme/internal-toolkit/auth-kit

bun x shadcn-svelte@latest add acme/internal-toolkit/auth-kit

pnpm dlx shadcn-svelte@latest registry validate acme/internal-toolkit

npx shadcn-svelte@latest registry validate acme/internal-toolkit

npx shadcn-svelte@latest registry validate acme/internal-toolkit

bun x shadcn-svelte@latest registry validate acme/internal-toolkit

How it works #

• Public repositories are read anonymously, exactly as before. No credentials are used and the GitHub CLI is never invoked.
• The CLI tries anonymous access first and only uses your credentials when the repository is not publicly readable.
• Private files are read through GitHub's Contents API, pinned to the resolved commit SHA.
• A token from GH_TOKEN is only ever sent to api.github.com. Stored GitHub CLI credentials are read by gh, not by the CLI.

See the Private repositories docs for the full guide.

You can now turn any public GitHub repository into a registry.

Add a registry.json file at the root of the repository, define the items you want to distribute, and users can install them directly from GitHub with the shadcn-svelte CLI.

pnpm dlx shadcn-svelte@latest add <username>/<repo>/<item>

For example, to install the project-conventions item from the acme/toolkit repository:

pnpm dlx shadcn-svelte@latest add acme/toolkit/project-conventions

GitHub registries are source registries. You do not need to run shadcn-svelte registry build, publish generated item JSON files, or set up a registry server. The CLI reads the root registry.json, resolves include entries, finds the requested item, and installs the files declared by that item.

Distribute anything #

Registry items are not limited to components. A GitHub registry can distribute components, hooks, utilities, design tokens, feature kits, project conventions, agent instructions, testing setup, CI workflows, release workflows, templates, codemods, migration kits, and other project files.

For example, a repository can expose a project-conventions item that installs shared docs, editor settings, and agent instructions:

{
  "$schema": "https://shadcn-svelte.com/schema/registry.json",
  "name": "acme-toolkit",
  "homepage": "https://github.com/acme/toolkit",
  "items": [
    {
      "name": "project-conventions",
      "type": "registry:item",
      "files": [
        {
          "path": "AGENTS.md",
          "type": "registry:file",
          "target": "~/AGENTS.md"
        },
        {
          "path": ".editorconfig",
          "type": "registry:file",
          "target": "~/.editorconfig"
        },
        {
          "path": "docs/conventions.md",
          "type": "registry:file",
          "target": "~/docs/conventions.md"
        }
      ]
    }
  ]
}

Commands #

GitHub registry addresses work with the registry commands supported by shadcn-svelte.

Validate a GitHub registry:

pnpm dlx shadcn-svelte@latest registry validate acme/toolkit

Install an item:

pnpm dlx shadcn-svelte@latest add acme/toolkit/project-conventions

See the GitHub Registries docs for the full guide.