tutorial

Monitoring Lerna Monorepo Pipelines with Vigilmon: Package Publish Health, CI Uptime & Registry Alerts

How to monitor Lerna JavaScript/TypeScript monorepo pipelines with Vigilmon — npm registry uptime, CI pipeline health, package publish endpoint monitoring, and release alerts.

Lerna manages JavaScript and TypeScript monorepos — versioning packages in lockstep or independently, running cross-package tests, and orchestrating npm publish across dozens of packages simultaneously. When the infrastructure supporting a Lerna release pipeline breaks, the damage is non-obvious: packages may publish partially, version tags get applied without matching npm artifacts, and consumers pull stale packages without realizing the release failed. Vigilmon gives you external visibility into the services that Lerna depends on — npm registry endpoints, CI runners, custom registry servers, and package verification endpoints — so you catch publish failures before consumers are affected.

What You'll Build

  • A monitor on the npm registry (or your private registry) to catch dependency resolution and publish failures
  • A monitor on your CI/CD API endpoint for pipeline health
  • An HTTP check on your Verdaccio or other private registry if you run one
  • SSL certificate monitoring for all custom registry domains
  • An alerting setup that distinguishes registry outages from pipeline failures

Prerequisites

  • A Lerna monorepo (version 5.x, 6.x, or the maintained @lerna/ scoped packages via Nx)
  • npm packages published to npm registry or a private registry (Verdaccio, Artifactory, GitHub Packages)
  • A CI/CD system (GitHub Actions, GitLab CI, CircleCI, etc.) running Lerna version and publish
  • A free account at vigilmon.online

Step 1: Identify Your Registry Endpoints

Lerna publishes packages to an npm-compatible registry. Identify the registry endpoint in your .npmrc or lerna.json:

// lerna.json
{
  "version": "independent",
  "npmClient": "npm",
  "command": {
    "publish": {
      "registry": "https://registry.example.com"
    }
  }
}

Or in .npmrc:

registry=https://registry.example.com

The npm registry (and compatible registries) expose a ping endpoint:

# Test npm registry
curl https://registry.npmjs.org/-/ping
# Returns {"db_name":"registry"}

# Test Verdaccio private registry
curl https://registry.example.com/-/ping
# Returns {"ok":"true"} or {"db_name":"registry"}

# Test GitHub Packages
curl https://npm.pkg.github.com/-/ping

Verify this endpoint returns 200 before setting up Vigilmon monitors.

Step 2: Monitor the npm Registry Endpoint

Even if you publish to a private registry, your Lerna monorepo almost certainly installs peer dependencies from the public npm registry. If npm goes down during a release run, lerna bootstrap or npm install across packages fails with confusing timeout errors.

  1. Log in to Vigilmon → Add Monitor → HTTP.
  2. URL: https://registry.npmjs.org/-/ping.
  3. Check interval: 5 minutes.
  4. Response timeout: 15 seconds.
  5. Expected status: 200.
  6. Keyword: db_name.
  7. Label: npm registry ping.
  8. Click Save.

This monitor alerts you when:

  • npm has an outage (rare but impactful for Lerna releases)
  • Your CI network can't reach npm (useful if you notice this is only Vigilmon that sees it)
  • CDN-level npm issues affect specific artifact types

Network-scoped issue: Vigilmon runs external checks from outside your network. If Vigilmon shows npm as healthy but your CI runner can't resolve packages, the issue is with your CI runner's network egress, DNS resolver, or corporate firewall — not npm itself. This distinction saves significant troubleshooting time.

Step 3: Monitor Your Private Registry (Verdaccio or Artifactory)

If you publish Lerna packages to a private registry, it's the single point of failure for your entire publish pipeline. A private registry outage means:

  • Lerna --registry flag points to an unreachable server
  • Every consumer across your org gets npm ERR! 404 for internal packages
  • Rollback to previous versions fails if the old tarball can't be fetched

For Verdaccio:

curl https://registry.example.com/-/ping
# Returns {"ok":"true"} when Verdaccio is healthy
  1. Add Monitor → HTTP.
  2. URL: https://registry.example.com/-/ping.
  3. Check interval: 60 seconds.
  4. Response timeout: 10 seconds.
  5. Expected status: 200.
  6. Keyword: ok.
  7. Label: Verdaccio private registry.
  8. Click Save.

For GitHub Packages (if using as your private registry):

  1. URL: https://npm.pkg.github.com/-/ping.
  2. Expected status: 200.
  3. Label: GitHub Packages registry.

When the private registry monitor fires during a Lerna release run, abort the release immediately — partial publishes create version inconsistencies across the monorepo packages that are difficult to untangle.

Step 4: Monitor the CI/CD API for Pipeline Health

Lerna's publish workflow is triggered by CI (usually on a push to main or a manual release trigger). If your CI/CD platform is degraded, the Lerna publish job may not trigger at all — or may be stuck in a queue without alerting anyone.

For GitHub Actions (most common for Lerna projects):

# GitHub API health check
curl -I https://api.github.com
# Returns 200 when GitHub API is operational
  1. Add Monitor → HTTP.
  2. URL: https://api.github.com.
  3. Check interval: 5 minutes.
  4. Response timeout: 10 seconds.
  5. Expected status: 200.
  6. Label: GitHub API (CI/CD health).
  7. Click Save.

For GitLab CI:

curl https://gitlab.example.com/-/health
# Returns 200 with "GitLab OK" when GitLab is healthy
  1. URL: https://gitlab.example.com/-/health.
  2. Keyword: GitLab OK.
  3. Label: GitLab CI health.

CI degradation vs. outage: If your CI API monitor fires but the npm registry is healthy, Lerna releases may be stuck in queue or failing to trigger. Check your CI platform's status page and runner availability — this is often a runner quota or autoscaling issue rather than a platform outage.

Step 5: Monitor Package Verification Endpoints

After a successful Lerna publish, consumers can immediately install the new packages. You can monitor a specific package's existence on the registry to verify publishes succeeded:

# Verify a published package exists in npm
curl https://registry.npmjs.org/@your-org/your-package/latest
# Returns 200 with package metadata when the package is available
  1. Add Monitor → HTTP.
  2. URL: https://registry.npmjs.org/@your-org/your-package/latest.
  3. Check interval: 15 minutes.
  4. Expected status: 200.
  5. Keyword: version (appears in all npm package metadata responses).
  6. Label: @your-org/your-package availability.
  7. Click Save.

This monitor catches silent publish failures — cases where lerna publish exits successfully but the package tarball wasn't actually uploaded to the registry due to a transient network error.

Step 6: Monitor SSL Certificates for Registry Domains

An expired SSL certificate on your private registry causes npm ERR! request to https://registry.example.com failed, reason: certificate has expired — one of the most jarring errors for developers expecting a routine npm install. The fix is simple but the blast radius is large: every developer and every CI job that touches internal packages breaks simultaneously.

  1. Add Monitor → SSL Certificate.
  2. Domain: registry.example.com.
  3. Alert when expiry is within: 30 days.
  4. Alert again: 14 days, 7 days, 3 days.
  5. Click Save.

Repeat for any additional domains in your registry infrastructure.

# Manually check certificate expiry
openssl s_client -connect registry.example.com:443 2>/dev/null | openssl x509 -noout -dates

Verdaccio TLS: If you terminate TLS at a reverse proxy (nginx, Traefik, Caddy) in front of Verdaccio, monitor the domain the reverse proxy serves — not the Verdaccio port directly. Lerna connects through the proxy, so that's the certificate that matters.

Step 7: Configure Alerting

In Vigilmon under Settings → Notifications, set up your alert routing:

| Monitor | Trigger | Action | |---|---|---| | npm registry ping | Non-200 or db_name missing | Check npmjs.com status; hold any pending Lerna release until npm recovers | | Private registry | Non-200 | Stop any active Lerna publish runs immediately; restore Verdaccio or check GitHub Packages status | | GitHub/GitLab CI API | Non-200 | Check CI platform status; verify runner availability and queue depth | | Package verification | Non-200 or keyword missing | Investigate whether last lerna publish succeeded; manually verify tarball on registry | | SSL certificate | < 30 days to expiry | Renew certificate; alert engineering on timeline to avoid install failures |

Alert after: 2 consecutive failures for HTTP monitors; 1 failure for TCP monitors.

Common Lerna Pipeline Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | npm registry outage | npm ping monitor fires; lerna bootstrap and lerna publish block | | Private registry (Verdaccio) crash | Private registry monitor fires; all internal package installs fail | | CI platform degraded | CI API monitor fires; Lerna publish job never triggers | | Partial publish (network drop mid-publish) | Package verification monitor fires for missing packages | | SSL certificate expires on private registry | SSL monitor at 30 days; npm install fails for all internal packages | | GitHub Packages rate limiting | Periodic 429 responses; monitor shows intermittent failures | | Registry disk full (Verdaccio) | Publish succeeds but tarball isn't stored; package verification catches it | | DNS misconfiguration for registry domain | All registry monitors fire simultaneously; CI can't resolve registry hostname |

Lerna publish failures are insidious — the CI job may exit 0 while only 8 of 12 packages actually made it to the registry. By the time a consumer reports a missing package, the release is already incomplete and reverting is painful. Vigilmon's package verification monitors, registry health checks, and SSL alerts give you the observability layer to catch these failures at the moment they happen — not when a downstream consumer files a bug report.

Start monitoring your Lerna monorepo pipeline in under 5 minutes — register free at vigilmon.online.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles