> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure integration with Google Artifact Registry

> Learn how to configure Endor Labs to authenticate with Google Artifact Registry for agentless dependency scanning.

export const BadgeTabs = ({children}) => {
  const DEFAULT_BADGE_COLOR = 'gray';
  const FALLBACK_TAB_PREFIX = 'Tab ';
  const ARIA_ID_PREFIX = 'bt-tab-';
  const ACCENT_GREEN = '#26D07C';
  const BADGE_COLOR_CLASS = {
    green: 'bt-badge--green',
    blue: 'bt-badge--blue',
    orange: 'bt-badge--orange',
    red: 'bt-badge--red',
    purple: 'bt-badge--purple',
    yellow: 'bt-badge--yellow',
    gray: 'bt-badge--gray'
  };
  const readDataAttr = (props, kebabName) => {
    if (!props || typeof props !== 'object') return undefined;
    const direct = props[kebabName];
    if (direct !== undefined && direct !== null) return String(direct);
    return undefined;
  };
  const normalizeBadgeColor = raw => {
    if (!raw) return DEFAULT_BADGE_COLOR;
    const c = String(raw).toLowerCase().trim();
    return BADGE_COLOR_CLASS[c] ? c : DEFAULT_BADGE_COLOR;
  };
  const flattenChildren = (node, out) => {
    if (node === null || node === undefined) return;
    if (Array.isArray(node)) {
      for (const item of node) flattenChildren(item, out);
      return;
    }
    out.push(node);
  };
  const childToTabItem = (child, index, itemCount) => {
    if (child === null || child === undefined) return null;
    if (typeof child === 'string' || typeof child === 'number') {
      const text = String(child).trim();
      if (!text) return null;
      return {
        key: `text-${index}`,
        title: `${FALLBACK_TAB_PREFIX}${itemCount + 1}`,
        badgeText: '',
        badgeColor: DEFAULT_BADGE_COLOR,
        node: <span>{child}</span>
      };
    }
    if (typeof child !== 'object' || !child.props) return null;
    const p = child.props;
    const title = readDataAttr(p, 'data-title')?.trim() || `${FALLBACK_TAB_PREFIX}${itemCount + 1}`;
    const badgeText = readDataAttr(p, 'data-badge')?.trim() || '';
    const badgeColor = normalizeBadgeColor(readDataAttr(p, 'data-badge-color'));
    return {
      key: child.key == null ? `tab-${index}` : String(child.key),
      title,
      badgeText,
      badgeColor,
      node: child
    };
  };
  const tabItems = useMemo(() => {
    const arr = [];
    flattenChildren(children, arr);
    const items = [];
    for (const [i, child] of arr.entries()) {
      const item = childToTabItem(child, i, items.length);
      if (item) items.push(item);
    }
    return items;
  }, [children]);
  const [activeIndex, setActiveIndex] = useState(0);
  const [isDark, setIsDark] = useState(false);
  const [baseId] = useState(() => `${ARIA_ID_PREFIX}${Math.random().toString(36).slice(2, 11)}`);
  useEffect(() => {
    const check = () => {
      const r = document.documentElement;
      setIsDark(r.dataset.theme === 'dark' || r.classList.contains('dark'));
    };
    check();
    const obs = new MutationObserver(check);
    obs.observe(document.documentElement, {
      attributes: true,
      attributeFilter: ['data-theme', 'class']
    });
    return () => obs.disconnect();
  }, []);
  useEffect(() => {
    if (activeIndex >= tabItems.length && tabItems.length > 0) setActiveIndex(0);
  }, [activeIndex, tabItems.length]);
  const safeIndex = tabItems.length === 0 ? 0 : Math.min(activeIndex, tabItems.length - 1);
  const focusTabAt = nextIndex => {
    if (tabItems.length === 0) return;
    const wrapped = (nextIndex % tabItems.length + tabItems.length) % tabItems.length;
    setActiveIndex(wrapped);
    const btn = document.getElementById(`${baseId}-tab-${wrapped}`);
    if (btn && typeof btn.focus === 'function') btn.focus();
  };
  const onKeyDownTabList = event => {
    if (tabItems.length === 0) return;
    const key = event.key;
    if (key === 'ArrowRight' || key === 'ArrowDown') {
      event.preventDefault();
      focusTabAt(safeIndex + 1);
    } else if (key === 'ArrowLeft' || key === 'ArrowUp') {
      event.preventDefault();
      focusTabAt(safeIndex - 1);
    } else if (key === 'Home') {
      event.preventDefault();
      focusTabAt(0);
    } else if (key === 'End') {
      event.preventDefault();
      focusTabAt(tabItems.length - 1);
    }
  };
  if (tabItems.length === 0) return null;
  const containerStyle = {
    borderRadius: '0.5rem',
    overflow: 'hidden',
    border: isDark ? '1px solid rgba(38,208,124,0.2)' : '1px solid #a7e8c8',
    margin: '1rem 0'
  };
  const navStyle = {
    display: 'flex',
    flexWrap: 'wrap',
    gap: 0,
    background: isDark ? 'rgba(38,208,124,0.1)' : '#e6f9f0',
    borderBottom: isDark ? '1px solid rgba(38,208,124,0.2)' : '1px solid #a7e8c8',
    padding: '0 0.75rem'
  };
  const btnStyle = selected => ({
    display: 'inline-flex',
    alignItems: 'center',
    gap: '0.35rem',
    padding: '0.6rem 0.75rem',
    border: 'none',
    borderBottom: selected ? `2px solid ${ACCENT_GREEN}` : '2px solid transparent',
    background: 'transparent',
    color: isDark ? selected ? '#e6edf3' : 'rgba(255,255,255,0.6)' : selected ? '#111827' : '#4b5563',
    cursor: 'pointer',
    fontSize: '0.85rem',
    fontWeight: selected ? 600 : 400
  });
  const panelStyle = {
    padding: '1rem 1.25rem'
  };
  return <div className="bt-root" style={containerStyle}>
      <div className="not-prose bt-tablist" role="tablist" aria-orientation="horizontal" tabIndex={-1} onKeyDown={onKeyDownTabList} style={navStyle}>
        {tabItems.map((tab, index) => {
    const selected = index === safeIndex;
    const tabId = `${baseId}-tab-${index}`;
    const panelId = `${baseId}-panel-${index}`;
    const badgeClass = BADGE_COLOR_CLASS[tab.badgeColor] || BADGE_COLOR_CLASS.gray;
    return <button key={tab.key} type="button" id={tabId} role="tab" aria-selected={selected} aria-controls={panelId} tabIndex={selected ? 0 : -1} className={`bt-tab-btn${selected ? ' bt-tab-btn--active' : ''}`} style={btnStyle(selected)} onClick={() => setActiveIndex(index)}>
              <span className="bt-tab-title">{tab.title}</span>
              {tab.badgeText ? <span className={`bt-badge ${badgeClass}`}>{tab.badgeText}</span> : null}
            </button>;
  })}
      </div>
      {tabItems.map((tab, index) => {
    const panelId = `${baseId}-panel-${index}`;
    const tabId = `${baseId}-tab-${index}`;
    const hidden = index !== safeIndex;
    return <div key={`${tab.key}-panel`} id={panelId} role="tabpanel" aria-labelledby={tabId} hidden={hidden} className="bt-tabpanel" style={{
      display: hidden ? 'none' : 'block',
      ...panelStyle
    }}>
            {tab.node}
          </div>;
  })}
    </div>;
};

export const YamlTable = ({children, data: propData, content}) => {
  const KV_RE = /^([A-Za-z][A-Za-z0-9_()/#\s-]+?):\s*(.+)$/;
  const INLINE_MD_RE = /(\[([^\]]+)\]\(([^)]+)\))|(`([^`]+)`)|(\*\*([^*]+)\*\*)|(\*([^*]+)\*)/g;
  const YES_RE = /^-yes-$/i;
  const NO_RE = /^-no-$/i;
  const LIMITED_RE = /^-(limited|partial)-$/i;
  const NA_RE = /^-(na|none)-$/i;
  const NA2_RE = /^-na2-$/i;
  const SIMPLE_TAG_RE = /(<br\s*\/?>)|(<p\s*\/?>)|(-note-)|(-warning-)/gi;
  const tryParseKV = trimmed => {
    const m = KV_RE.exec(trimmed);
    return m ? {
      key: m[1],
      value: m[2].trim()
    } : null;
  };
  const registerKey = (key, seenKeys, orderedKeys) => {
    if (!seenKeys.has(key)) {
      orderedKeys.push(key);
      seenKeys.add(key);
    }
  };
  const flushEntry = (currentEntry, entries) => {
    if (Object.keys(currentEntry).length > 0) entries.push(currentEntry);
  };
  const parseDashPrefixed = (lines, entries, orderedKeys, seenKeys) => {
    let currentEntry = {};
    let inEntry = false;
    for (const line of lines) {
      const trimmed = line.trim();
      if (trimmed.startsWith('- ')) {
        if (inEntry) entries.push(currentEntry);
        currentEntry = {};
        inEntry = true;
        const kv = tryParseKV(trimmed.substring(2).trim());
        if (kv) {
          registerKey(kv.key, seenKeys, orderedKeys);
          currentEntry[kv.key] = kv.value;
        }
      } else if (inEntry && trimmed !== '') {
        const kv = tryParseKV(trimmed);
        if (kv) {
          registerKey(kv.key, seenKeys, orderedKeys);
          currentEntry[kv.key] = kv.value;
        }
      }
    }
    flushEntry(currentEntry, entries);
  };
  const parseBlankSeparated = (lines, entries, orderedKeys, seenKeys) => {
    let currentEntry = {};
    let inEntry = false;
    for (const line of lines) {
      const trimmed = line.trim();
      if (trimmed === '') {
        if (inEntry) {
          flushEntry(currentEntry, entries);
          currentEntry = {};
          inEntry = false;
        }
        continue;
      }
      const kv = tryParseKV(trimmed);
      if (!kv) continue;
      const isNewEntry = !line.startsWith(' ') && !line.startsWith('\t');
      if (isNewEntry && inEntry && Object.keys(currentEntry).length > 0) {
        entries.push(currentEntry);
        currentEntry = {};
      }
      registerKey(kv.key, seenKeys, orderedKeys);
      currentEntry[kv.key] = kv.value;
      inEntry = true;
    }
    flushEntry(currentEntry, entries);
  };
  const normalizeEntries = (entries, orderedKeys) => entries.map(entry => {
    const filled = {};
    for (const key of orderedKeys) filled[key] = entry[key] || '';
    return filled;
  });
  const parseYamlTableContent = contentStr => {
    if (!contentStr) return [];
    const entries = [];
    const orderedKeys = [];
    const seenKeys = new Set();
    const lines = contentStr.split('\n');
    if (lines.some(line => line.trim().startsWith('- '))) {
      parseDashPrefixed(lines, entries, orderedKeys, seenKeys);
    } else {
      parseBlankSeparated(lines, entries, orderedKeys, seenKeys);
    }
    return normalizeEntries(entries, orderedKeys);
  };
  const processText = text => {
    if (!text) return text;
    const parts = [];
    let keyIndex = 0;
    let lastIndex = 0;
    let match;
    while ((match = INLINE_MD_RE.exec(text)) !== null) {
      if (match.index > lastIndex) parts.push(text.slice(lastIndex, match.index));
      if (match[1]) {
        parts.push(<a key={keyIndex++} href={match[3]}>{match[2]}</a>);
      } else if (match[4]) {
        parts.push(<code key={keyIndex++}>{match[5]}</code>);
      } else if (match[6]) {
        parts.push(<strong key={keyIndex++}>{match[7]}</strong>);
      } else if (match[8]) {
        parts.push(<em key={keyIndex++}>{match[9]}</em>);
      }
      lastIndex = match.index + match[0].length;
    }
    if (lastIndex < text.length) parts.push(text.slice(lastIndex));
    if (parts.length === 0) return text;
    const keyRef = {
      current: keyIndex
    };
    return expandHtmlTags(parts, keyRef);
  };
  const processBadges = text => {
    if (!text || typeof text !== 'string') return text;
    if (YES_RE.test(text)) return <span className="yt-badge-yes" role="img" aria-label="Supported" title="Supported">✓</span>;
    if (NO_RE.test(text)) return <span className="yt-badge-no" role="img" aria-label="Not supported" title="Not supported">✗</span>;
    if (LIMITED_RE.test(text)) return <span className="yt-badge-limited" role="img" aria-label="Partially supported" title="Partially supported">◐</span>;
    if (NA_RE.test(text) || NA2_RE.test(text)) return <span className="yt-sr-only" title="Not applicable">Not applicable</span>;
    return processText(text);
  };
  const cellClassName = text => {
    if (!text || typeof text !== 'string') return undefined;
    if (NA_RE.test(text)) return 'yt-cell-na';
    if (NA2_RE.test(text)) return 'yt-cell-na2';
    return undefined;
  };
  const expandSimpleTags = (str, keyRef) => {
    const result = [];
    let last = 0;
    SIMPLE_TAG_RE.lastIndex = 0;
    let m;
    while ((m = SIMPLE_TAG_RE.exec(str)) !== null) {
      if (m.index > last) result.push(str.slice(last, m.index));
      if (m[1]) {
        result.push(<br key={keyRef.current++} />);
      } else if (m[2]) {
        result.push(<br key={keyRef.current++} />, <br key={keyRef.current++} />);
      } else if (m[3]) {
        result.push(<span key={keyRef.current++} className="yt-badge-note" style={{
          fontWeight: 600
        }}>Note: </span>);
      } else if (m[4]) {
        result.push(<span key={keyRef.current++} className="yt-badge-warning" style={{
          fontWeight: 600
        }}>Warning: </span>);
      }
      last = m.index + m[0].length;
    }
    if (last < str.length) result.push(str.slice(last));
    return result;
  };
  const expandHtmlTags = (chunks, keyRef) => {
    const out = [];
    for (const chunk of chunks) {
      if (typeof chunk === 'string') {
        out.push(...expandSimpleTags(chunk, keyRef));
      } else {
        out.push(chunk);
      }
    }
    return out;
  };
  const extractText = node => {
    if (node === null || node === undefined) return '';
    if (typeof node === 'string') return node;
    if (typeof node === 'number') return String(node);
    if (typeof node === 'boolean') return '';
    if (Array.isArray(node)) return node.map(extractText).join('');
    if (node && typeof node === 'object' && node.type) {
      const props = node.props || ({});
      if (typeof props.children === 'string') return props.children;
      if (props.children) return extractText(props.children);
      return '';
    }
    return String(node || '');
  };
  const [mounted, setMounted] = useState(false);
  useEffect(() => {
    setMounted(true);
  }, []);
  const data = useMemo(() => {
    if (propData) return propData;
    if (content && typeof content === 'string') return parseYamlTableContent(content);
    if (!children) return [];
    if (typeof children === 'string') return parseYamlTableContent(children);
    const childrenArray = Array.isArray(children) ? children : [children];
    return parseYamlTableContent(childrenArray.map(extractText).join('').trim());
  }, [children, propData, content]);
  const columns = useMemo(() => {
    if (!data || data.length === 0) return [];
    const firstRow = data[0];
    if (!firstRow || typeof firstRow !== 'object') return [];
    return Object.keys(firstRow);
  }, [data]);
  if (!mounted) return null;
  if (!data || data.length === 0) return null;
  const rowKey = row => columns.map(c => row[c] || '').join('|');
  return <table>
      <thead>
        <tr>
          {columns.map(col => <th key={col}>{col.replaceAll('_', ' ')}</th>)}
        </tr>
      </thead>
      <tbody>
        {data.map(row => <tr key={rowKey(row)}>
            {columns.map(col => <td key={col} className={cellClassName(row[col])}>{processBadges(row[col])}</td>)}
          </tr>)}
      </tbody>
    </table>;
};

Configure Endor Labs to integrate with Google Artifact Registry (GAR) to resolve private npm, Maven, Gradle, and PyPI packages during agentless scans. GAR uses short-lived OAuth2 access tokens instead of static credentials. Endor Labs creates these tokens automatically at scan time from a service account key that you store securely in the platform.

When you configure a GAR integration, Endor Labs stores your encrypted service account key. At scan start, Endor Labs creates a short-lived OAuth2 access token from the stored key, and injects the registry URL and token into the package manager resolver.

<Note>
  The token is valid for approximately one hour.
</Note>

## Supported ecosystems

<YamlTable>
  {`
    - Ecosystem: npm
    Registry URL: https://{location}-npm.pkg.dev/{project}/{repo}/
    - Ecosystem: Maven
    Registry URL: https://{location}-maven.pkg.dev/{project}/{repo}
    - Ecosystem: Gradle
    Registry URL: https://{location}-maven.pkg.dev/{project}/{repo}
    - Ecosystem: PyPI
    Registry URL: https://{location}-python.pkg.dev/{project}/{repo}/simple/
    `}
</YamlTable>

<Note>
  NuGet, Cargo, RubyGems, CocoaPods, and Swift are not supported because Google Artifact Registry does not offer these formats.
</Note>

## Set up a GCP service account

To create a GCP service account with read access to your Artifact Registry repositories:

1. In Google Cloud Console, go to **IAM & Admin** > **Service Accounts**.
2. Select **Create Service Account** and enter a name such as `endor-gar-reader`.
3. Grant the service account the `roles/artifactregistry.reader` role on the target project or repository.
4. Open the service account and select **Keys**.
5. Select **Add Key** > **Create new key**.
6. Choose **JSON** as the key type and select **Create**.
7. Save the downloaded JSON key file and use it when you add the integration.

## Configure a GAR package manager integration

To connect Endor Labs to your Artifact Registry repositories:

1. Select **User menu** > **Integrations** from the left sidebar.
2. Select **Add** next to the package manager type you want to configure.
3. Select **Add Package Manager**.
4. Enter a **Name** for the integration.
5. Choose **Google Artifact Registry** as the authentication type.
6. Enter your **GCP Project ID**, the ID of the GCP project that hosts the Artifact Registry repository.
7. Enter the **Location**, the GCP region where your repository is hosted, for example `us-central1`.
8. Enter the **Repository**, the name of your GAR repository.
9. Enter the full contents of the downloaded JSON key file in **Service Account Key**.
10. Optionally, under **Advanced**, select **Propagate this package manager to all child namespaces** to share this integration with child namespaces.
11. Optionally, under **Advanced**, select **Use this package manager as a plugin repository** if this registry hosts build plugins rather than library dependencies.
12. Click **Add Package Manager**.

Endor Labs tests the connection immediately. If the status indicates a failure, verify that the service account key is valid and that the service account has the roles/artifactregistry.reader role on the target repository.

<Warning>
  After the integration is saved, the service account key is redacted from all API responses. Store a copy of the JSON key file in a secure location before submitting it.
</Warning>

## Configure a GAR package manager integration using the API

Use endorctl to create a GAR package manager resource through the API.

The following table lists the parameters required to create the integration.

<YamlTable>
  {`
    - Parameter: \`<namespace>\`
    Description: Your Endor Labs namespace
    - Parameter: \`<integration-name>\`
    Description: A descriptive name for the integration
    - Parameter: \`<gcp-project-id>\`
    Description: Your GCP project ID
    - Parameter: \`<gcp-region>\`
    Description: The GAR repository region, for example \`us-central1\`
    - Parameter: \`<repository-name>\`
    Description: The name of your GAR repository
    - Parameter: \`<service-account-key-json>\`
    Description: The full JSON contents of your service account key file
    `}
</YamlTable>

<BadgeTabs>
  <div data-title="npm">
    ```bash theme={null}
    endorctl api create -r PackageManager -n <namespace> -d '{
      "meta": {
        "name": "<integration-name>"
      },
      "spec": {
        "auth_provider": {
          "gar": {
            "project_id": "<gcp-project-id>",
            "location": "<gcp-region>",
            "repository": "<repository-name>",
            "service_account_key": "<service-account-key-json>"
          }
        },
        "npm": {
          "priority": 1
        }
      },
      "propagate": true
    }'
    ```
  </div>

  <div data-title="Maven">
    ```bash theme={null}
    endorctl api create -r PackageManager -n <namespace> -d '{
      "meta": {
        "name": "<integration-name>"
      },
      "spec": {
        "auth_provider": {
          "gar": {
            "project_id": "<gcp-project-id>",
            "location": "<gcp-region>",
            "repository": "<repository-name>",
            "service_account_key": "<service-account-key-json>"
          }
        },
        "maven": {
          "priority": 1
        }
      },
      "propagate": true
    }'
    ```
  </div>

  <div data-title="Gradle">
    <Note>
      Endor Labs automatically sets the Gradle property key to `ARTIFACT_REGISTRY_AUTH_TOKEN` at scan time.
    </Note>

    ```bash theme={null}
    endorctl api create -r PackageManager -n <namespace> -d '{
      "meta": {
        "name": "<integration-name>"
      },
      "spec": {
        "auth_provider": {
          "gar": {
            "project_id": "<gcp-project-id>",
            "location": "<gcp-region>",
            "repository": "<repository-name>",
            "service_account_key": "<service-account-key-json>"
          }
        },
        "gradle": {
          "priority": 1
        }
      },
      "propagate": true
    }'
    ```
  </div>

  <div data-title="PyPI">
    ```bash theme={null}
    endorctl api create -r PackageManager -n <namespace> -d '{
      "meta": {
        "name": "<integration-name>"
      },
      "spec": {
        "auth_provider": {
          "gar": {
            "project_id": "<gcp-project-id>",
            "location": "<gcp-region>",
            "repository": "<repository-name>",
            "service_account_key": "<service-account-key-json>"
          }
        },
        "pypi": {
          "priority": 1
        }
      },
      "propagate": true
    }'
    ```
  </div>
</BadgeTabs>

## Known limitations

* **Token lifetime**: GAR access tokens expire approximately one hour after they are minted. A token is minted at the start of the scan and used for package resolution. If package resolution begins more than one hour after the scan starts, authentication fails with a `401 Unauthorized` error. Re-run the scan to generate a new access token and start a fresh one-hour window.
* **Long-lived service account key**: The JSON key you provide remains valid until you revoke it in GCP. Rotate the key periodically following your organization's credential management practices and update the integration in Endor Labs after rotation.
* **Workload Identity Federation**: Keyless authentication through Workload Identity Federation is not supported in this release.