Repository navigation
Document of publish with NPM_TOKEN not accurately while use actions/setup-node #132
Description
Activity
We've kinda wanted to deprecate the built-in authentication - the code for it still has to be in the project cause we don't want to release a new major version now but we should remove mentions of that from the docs.
One of the problems that we have wanted to solve by that is better compatibility with Yarn Berry. They are not using
.npmrcat all and trying to figure out how to properly set up auth credentials for a given project while making sure that we don't override anything is annoying and error-prone. By making users just set up the auth withsetup-nodeor their own scripts we just remove the problem altogether, by shifting this responsibility to more suited places.Reacted by Zeno Jiricek and Takeo YoshidaReacted by Al HindsI encountered that today, if we don't have .npmrc in .gitignore, this action generates .npmrc with no masked npm token and commit it due to this code automatically when publishing a library. It has potential risks to leak npm token if we use public repositories so that I must have replaced all npm tokens instead of leaked tokens.
I think creating .npmrc should not be default behavior.
Or replace//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}\nto '//registry.npmjs.org/:_authToken=${NPM_TOKEN}\n'.
A .npmrc file can usually read directly os environment variables and be safe if the file is committed, because NPM_TOKEN itself is not written in the file if you create accidentally .npmrc file.Please consider it.
I have made a POC commit and action here:
actions/setup-node, with theregistry-urlparamsNODE_AUTH_TOKENforchangesets/actionThere is no doubt, this commit will make action status from
successtofailure.Reason
As the annotation in screenshot,
actions/setup-nodewith theregistry-urlparams will create "user" config.npmrcwith_authToken=${NODE_AUTH_TOKEN},but it at
~/work/_temp/.npmrcnot~/.npmrc, as well as theuserconfigfield point to~/work/_temp/.npmrc.That's said in GitHub Actions Docs - Publishing packages to the npm registry.
So that
changesets/actionscreate and setup_authTokenwill not work.Therefore, without the
registry-urlparams, the action will success (POC: action log | commit),or set the
NODE_AUTH_TOKENenv, the action will also success (POC: action log | commit)Proposed
Maybe update the document about that case? A lot of people are using
setup-nodeandregistry-url