<h3 dir="auto">Is there an existing issue for this?</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have searched the existing issues</li>
</ul>
<h3 dir="auto">Current Behavior</h3>
<p dir="auto">Since NPM v7:</p>
<p dir="auto">When installing a new dependency from a public repository (<code class="notranslate">github:foo/bar</code>), this creates a <code class="notranslate">git+ssh://git@github.com/foo/bar</code>) in the <code class="notranslate">package-lock.json</code>.</p>
<p dir="auto">This breaks when running <code class="notranslate">npm ci</code> in  a GitHub Action because it doesn't have the SSH agent configured. And it shouldn't need to, because the dependency is public.</p>
<h3 dir="auto">Expected Behavior</h3>
<p dir="auto">Don't put <code class="notranslate">git+ssh</code> there but <code class="notranslate">github:</code>.</p>
<h3 dir="auto">Steps To Reproduce</h3>
<p dir="auto"><code class="notranslate">npm i github:foo/bar</code></p>
<h3 dir="auto">Environment</h3>
<ul dir="auto">
<li>OS: macOS Big Sur</li>
<li>Node 16</li>
<li>npm v7.12.1</li>
</ul>
<h3 dir="auto">Current Behavior:</h3>

<p dir="auto">When I use a git repository via an HTTP link NPM "takes liberties" with it, which breaks my build:</p>
<div class="highlight highlight-text-adblock notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="$ npm init -y
Wrote to /Users/eugene.lazutkin/Work/temp/package.json:

{
  &quot;name&quot;: &quot;temp&quot;,
  &quot;version&quot;: &quot;1.0.0&quot;,
  &quot;description&quot;: &quot;&quot;,
  &quot;main&quot;: &quot;index.js&quot;,
  &quot;scripts&quot;: {
    &quot;test&quot;: &quot;echo \&quot;Error: no test specified\&quot; &amp;&amp; exit 1&quot;
  },
  &quot;keywords&quot;: [],
  &quot;author&quot;: &quot;&quot;,
  &quot;license&quot;: &quot;ISC&quot;
}


$ npm i --save https://github.com/uhop/stream-chain.git

added 1 package, and audited 2 packages in 3s

found 0 vulnerabilities"><pre class="notranslate"><span class="pl-k">$</span> npm init -y
Wrote to /Users/eugene.lazutkin/Work/temp/package.json:

{
  "name": "temp",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" &amp;&amp; exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC"
}


<span class="pl-k">$</span> npm i --save https://github.com/uhop/stream-chain.git

added 1 package, and audited 2 packages in 3s

found 0 vulnerabilities</pre></div>
<p dir="auto">It produces <code class="notranslate">package-lock.json</code>:</p>
<div class="highlight highlight-source-json notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="{
  &quot;name&quot;: &quot;temp&quot;,
  &quot;version&quot;: &quot;1.0.0&quot;,
  &quot;lockfileVersion&quot;: 2,
  &quot;requires&quot;: true,
  &quot;packages&quot;: {
    &quot;&quot;: {
      &quot;version&quot;: &quot;1.0.0&quot;,
      &quot;license&quot;: &quot;ISC&quot;,
      &quot;dependencies&quot;: {
        &quot;stream-chain&quot;: &quot;github:uhop/stream-chain&quot;
      }
    },
    &quot;node_modules/stream-chain&quot;: {
      &quot;version&quot;: &quot;2.2.4&quot;,
      &quot;resolved&quot;: &quot;git+ssh://git@github.com/uhop/stream-chain.git#459f5a1708c138b6e0abaae4cf103c3488e1e78e&quot;,
      &quot;license&quot;: &quot;BSD-3-Clause&quot;
    }
  },
  &quot;dependencies&quot;: {
    &quot;stream-chain&quot;: {
      &quot;version&quot;: &quot;git+ssh://git@github.com/uhop/stream-chain.git#459f5a1708c138b6e0abaae4cf103c3488e1e78e&quot;,
      &quot;from&quot;: &quot;stream-chain@github:uhop/stream-chain&quot;
    }
  }
}"><pre class="notranslate">{
  <span class="pl-ent">"name"</span>: <span class="pl-s"><span class="pl-pds">"</span>temp<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"version"</span>: <span class="pl-s"><span class="pl-pds">"</span>1.0.0<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"lockfileVersion"</span>: <span class="pl-c1">2</span>,
  <span class="pl-ent">"requires"</span>: <span class="pl-c1">true</span>,
  <span class="pl-ent">"packages"</span>: {
    <span class="pl-ent">""</span>: {
      <span class="pl-ent">"version"</span>: <span class="pl-s"><span class="pl-pds">"</span>1.0.0<span class="pl-pds">"</span></span>,
      <span class="pl-ent">"license"</span>: <span class="pl-s"><span class="pl-pds">"</span>ISC<span class="pl-pds">"</span></span>,
      <span class="pl-ent">"dependencies"</span>: {
        <span class="pl-ent">"stream-chain"</span>: <span class="pl-s"><span class="pl-pds">"</span>github:uhop/stream-chain<span class="pl-pds">"</span></span>
      }
    },
    <span class="pl-ent">"node_modules/stream-chain"</span>: {
      <span class="pl-ent">"version"</span>: <span class="pl-s"><span class="pl-pds">"</span>2.2.4<span class="pl-pds">"</span></span>,
      <span class="pl-ent">"resolved"</span>: <span class="pl-s"><span class="pl-pds">"</span>git+ssh://git@github.com/uhop/stream-chain.git#459f5a1708c138b6e0abaae4cf103c3488e1e78e<span class="pl-pds">"</span></span>,
      <span class="pl-ent">"license"</span>: <span class="pl-s"><span class="pl-pds">"</span>BSD-3-Clause<span class="pl-pds">"</span></span>
    }
  },
  <span class="pl-ent">"dependencies"</span>: {
    <span class="pl-ent">"stream-chain"</span>: {
      <span class="pl-ent">"version"</span>: <span class="pl-s"><span class="pl-pds">"</span>git+ssh://git@github.com/uhop/stream-chain.git#459f5a1708c138b6e0abaae4cf103c3488e1e78e<span class="pl-pds">"</span></span>,
      <span class="pl-ent">"from"</span>: <span class="pl-s"><span class="pl-pds">"</span>stream-chain@github:uhop/stream-chain<span class="pl-pds">"</span></span>
    }
  }
}</pre></div>
<p dir="auto">Note that <code class="notranslate">https://github.com/uhop/stream-chain.git</code> was replaced with <code class="notranslate">github:uhop/stream-chain</code>, which is probably OK in this case. But other two links (?) are rewritten from <code class="notranslate">https://github.com/uhop/stream-chain.git</code> to <code class="notranslate">git+ssh://git@github.com/uhop/stream-chain.git</code>, which is clearly bad.</p>
<p dir="auto">The problem is that a build bot we use in similar situations can access private git repositories using HTTP, but not SSH for security reasons. It fails on an authentication. Rewriting <code class="notranslate">https://github.com/uhop/stream-chain.git</code> to <code class="notranslate">git+ssh://git@github.com/uhop/stream-chain.git</code> is not acceptable for that reasons.</p>
<p dir="auto">The fix is relatively minor yet unpleasant: we have to replace <code class="notranslate">npm ci</code> with <code class="notranslate">npm i</code>, which takes more time and introduced instabilities with other dependencies.</p>
<h3 dir="auto">Expected Behavior:</h3>

<p dir="auto">When running <code class="notranslate">npm ci</code> it should use the original URL with the HTTP authentication instead of SSH.</p>
<h3 dir="auto">Steps To Reproduce:</h3>

<p dir="auto">See the description and do the same steps using git repositories (github only?) as dependencies.</p>
<h3 dir="auto">Environment:</h3>

<p dir="auto">OS: Mac<br>
Node: 15.7.0<br>
NPM: 7.4.3</p>