mirror-helper/changesets-action
1
0
Fork 0
mirror of https://github.com/changesets/action synced 2026-10-26 16:39:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

Conditionally append NPM_TOKEN to .npmrc (#545)

Browse Source 
* fix: conditionally append NPM_TOKEN to .npmrc for trusted publishing support

The .npmrc generation now intelligently handles both traditional NPM token
authentication and trusted publishing scenarios:

- Only appends auth token to .npmrc when NPM_TOKEN is defined (not undefined)
- Uses strict comparison (!== undefined) instead of truthy checks
- Provides informative logging when no NPM_TOKEN is present
- Maintains full backward compatibility with existing workflows

This fixes issues with trusted publishing where OIDC tokens from GitHub
Actions are used instead of NPM_TOKEN, preventing 'undefined' from being
written to the registry auth configuration.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Update src/index.ts

Co-authored-by: Mateusz Burzyński <mateuszburzynski@gmail.com>

* simplify

* tweak changeset

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Mateusz Burzyński <mateuszburzynski@gmail.com>
This commit is contained in:
Ryan Bas
2026-01-27 23:14:11 +01:00
committed by GitHub
co-authored by Claude Mateusz Burzyński
parent 5e0dfa5699
commit 54220dd92c
2 changed files with 33 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/npmrc-trusted-publishing.md
+5
View File
@@ -0,0 +1,5 @@
---
"@changesets/action": patch
---
The `.npmrc` generation now intelligently handles both traditional NPM token authentication and trusted publishing scenarios by only appending the auth token when `NPM_TOKEN` is defined. This prevents 'undefined' from being written to the registry configuration when using OIDC tokens from GitHub Actions trusted publishing.
src/index.ts
+11 -2
View File
@@ -67,7 +67,9 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
"No changesets found. Attempting to publish any unpublished packages to npm"
);
let userNpmrcPath = `${process.env.HOME}/.npmrc`;
if (process.env.NPM_TOKEN) {
const userNpmrcPath = `${process.env.HOME}/.npmrc`;
if (await fileExists(userNpmrcPath)) {
core.info("Found existing user .npmrc file");
const userNpmrcContent = await fs.readFile(userNpmrcPath, "utf8");
@@ -89,12 +91,19 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
);
}
} else {
core.info("No user .npmrc file found, creating one");
core.info(
"No user .npmrc file found, creating one with NPM_TOKEN used as auth token"
);
await fs.writeFile(
userNpmrcPath,
`//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}\n`
);
}
} else {
core.info(
"No NPM_TOKEN found - assuming trusted publishing or npm is already authenticated"
);
}
const result = await runPublish({
script: publishScript,