Setup Node with GitHub Package Registry Keeps Denying Access

[gfyoung]

name: Node.js Package

# For facilitating testing.
on:
  push:
    branches:
      - '*'

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-node@v2
        with:
          node-version: '14.x'
          registry-url: 'https://npm.pkg.github.com'
      - run: npm install -g npm@next-7 && npm install
      - run: npm publish
        name: GitHub Publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

However, GH Actions keeps blocking: logs.txt

These instructions largely follow what you guys give in the README as well as https://docs.github.com/en/actions/guides/publishing-nodejs-packages

[gfyoung]

Checked against my local setup, and I see a couple of things:

• My package name isn't scoped in the GH Actions run I shared

Added back my @gfyoung, but even still:

setup-node/src/authutil.ts

Lines 19 to 61 in 66dfac5

	function writeRegistryToFile(
	registryUrl: string,
	fileLocation: string,
	alwaysAuth: string
	) {
	let scope: string = core.getInput('scope');
	if (!scope && registryUrl.indexOf('npm.pkg.github.com') > -1) {
	scope = github.context.repo.owner;
	}
	if (scope && scope[0] != '@') {
	scope = '@' + scope;
	}
	if (scope) {
	scope = scope.toLowerCase();
	}
	core.debug(`Setting auth in ${fileLocation}`);
	let newContents: string = '';
	if (fs.existsSync(fileLocation)) {
	const curContents: string = fs.readFileSync(fileLocation, 'utf8');
	curContents.split(os.EOL).forEach((line: string) => {
	// Add current contents unless they are setting the registry
	if (!line.toLowerCase().startsWith('registry')) {
	newContents += line + os.EOL;
	}
	});
	}
	// Remove http: or https: from front of registry.
	const authString: string =
	registryUrl.replace(/(^\w+:|^)/, '') + ':_authToken=${NODE_AUTH_TOKEN}';
	const registryString: string = scope
	? `${scope}:registry=${registryUrl}`
	: `registry=${registryUrl}`;
	const alwaysAuthString: string = `always-auth=${alwaysAuth}`;
	newContents += `${authString}${os.EOL}${registryString}${os.EOL}${alwaysAuthString}`;
	fs.writeFileSync(fileLocation, newContents);
	core.exportVariable('NPM_CONFIG_USERCONFIG', fileLocation);
	// Export empty node_auth_token if didn't exist so npm doesn't complain about not being able to find it
	core.exportVariable(
	'NODE_AUTH_TOKEN',
	process.env.NODE_AUTH_TOKEN || 'XXXXX-XXXXX-XXXXX-XXXXX'
	);
	}

• The registry entry is scoped by default i.e.

@gfyoung:registry=npm.pkg.github.com/

However, GitHub doesn't seem to like this. Locally, I just have:

registry=https://npm.pkg.github.com/

• The auth token entry is not prefixed with // i.e.

npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}

However, I have locally:

//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}

[dmitry-shibanov]

Hello @gfyoung. Thank you for your report. Sorry for the late response.

I think the issue was related to initial set up, because GitHub Packages should be scoped by repository's owner. You need to only add step to change name in package.json, as you did in the second commit run: echo $(jq '.name = "@gfyoung/basic-tts"' package.json) > package.json && npm publish without creating .npmrc in the root of the project.

If it's possible for you, could you please test it ?

Actually the action creates .npmrc file in the temporary directory and NPM_CONFIG_USERCONFIG environment variable to this file. The file has approximately a such content:

//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}
@user:registry=https://npm.pkg.github.com/
always-auth=false

If you used publishing to another registry before GitHub packages the content would be like this:

//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
always-auth=false
//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}
@user:registry=https://npm.pkg.github.com/
always-auth=false

Sorry, If I've misunderstood you.

[gfyoung]

@dmitry-shibanov: Thanks for the explanation. I have a working setup now, though I kept the issue since I wasn't sure why the sample yml that I shared in the issue was causing an error. Your explanation makes sense though, since it's pretty much what I did eventually. Closing this issue since it resolves my inquiry.

[6tukat]

### ###