Unable to publish unscoped packages to the GitHub Package Registry

[asbjornu]

As requested in #73 (comment), this issue is an attempt to explain how I'm unable to get setup-node to help me publish an unscoped NPM package to the GitHub Package Registry. The name of the package is vscode-remark (notice the lack of scope).

Here's the relevant job from my workflow:

publish-gpr:
  needs: build
  runs-on: ubuntu-latest
  steps:
    - uses: actions/download-artifact@v2
      with:
        name: vscode-remark
    - run: npm install
    - uses: actions/setup-node@v2
      with:
        registry-url: https://npm.pkg.github.com
        scope: '@remarkjs'
    - name: npm config
      run: npm config set registry https://npm.pkg.github.com/@remarkjs
    - run: npm publish
      env:
        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The npm publish step in the above workflow fails with the following error:

npm ERR! 401 Unauthorized - PUT https://npm.pkg.github.com/@remarkjs/vscode-remark - Your request could not be authenticated by the GitHub Packages service. Please ensure your access token is valid and has the appropriate scopes configured.

I've also tried to create an .npmrc file manually, like so:

- name: npm config
  run: |
    npm config set //npm.pkg.github.com/remarkjs/:_authToken=\${NODE_AUTH_TOKEN}
    npm config set registry https://npm.pkg.github.com/remarkjs/
    npm config set always-auth false

And by committing the following .npmrc file to Git:

//npm.pkg.github.com/remarkjs/:_authToken=${NODE_AUTH_TOKEN}
registry=https://npm.pkg.github.com/remarkjs/
always-auth=false

(The contents, including always-auth=false, is mostly identical to the contents of .npmrc after setup-node has executed). I've also tried adding publishConfig to my package.json:

"publishConfig": {
  "registry": "https://npm.pkg.github.com/remarkjs/"
},

However, all of these attempts fail with the following error:

405 Method Not Allowed - PUT https://npm.pkg.github.com/remarkjs/vscode-remark

If it's possible to publish an unscoped package to the GitHub Package Registry without modifying its name, by adding the scope through some other means only when publishing to GPR (but not to NPM), clear guidance to how that is accomplished would be highly appreciated.

Even better would be if setup-node was modified to take care of this or if there was an npm-publish action that took care of this automatically. The hacks seen outlined in #73 and #53 to "fix" this are rather bad, imho.

[joebowbeer]

To clear, you want to publish a remarkjs-scoped package to the remarkjs GPR (because GPR only allows remarkjs-scoped packages to be published to a remarkjs-owned repo) but you don't want to add the scope to the package name in package.json, right?

This possible.

Can you point to a specific failing package.json, . npmrc and build.yaml?

By the way, why is the repository in vscode-remark pointing to a mrmlnc-owned repo?

https://github.com/remarkjs/vscode-remark/blob/main/package.json#L15

[asbjornu]

To clear, you want to publish a remarkjs-scoped package to the remarkjs GPR (because GPR only allows remarkjs-scoped packages to be published to a remarkjs-owned repo) but you don't want to add the scope to the package name in package.json, right?

Correct!

This possible.

Cool!

Can you point to a specific failing package.json, . npmrc and build.yaml?

Sure, I'm working on this in remarkjs/vscode-remark#40, so please poke around there.

By the way, why is the repository in vscode-remark pointing to a mrmlnc-owned repo?

Because it has not yet been updated after being moved from @mrmlnc. That is part of what I'm working on in remarkjs/vscode-remark#40.

[dmitry-shibanov]

Hello everyone. Thank you for responses. GitHub Packages should be scoped. You can not publish unscoped packages to GitHub packages. You can override name of the package by this command:
npm init -y --scope ${{ github.repository_owner }}.

For now I'm going to close the issue. If you have any concerns feel free to ping us.