registry-url ignored completely

[CamJN]

Description:
The registry-url set in the config is ignored and npm is used unconditionally

Action version:
v4

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Tools version:
node version = v21.5.0
npm version = 10.2.4
see npm config list output in linked job for more

Repro steps:
https://github.com/getargv/getargv.js/blob/main/.github/workflows/npm.yml

Expected behavior:
The package is pushed to GPR.

Actual behavior:
https://github.com/getargv/getargv.js/actions/runs/7272407299/job/19814479275

[marko-zivic-93]

Hello @CamJN
Thank you for creating this issue, we will investigate it and come back to you as soon as we have some feedback.

[shaanmugapriya]

Hello @CamJN, Thank you for creating the issue once again.

I've tried to reproduce the issue with respect to setup-node package, but it is working as expected. I am suspecting the below can be the root cause for the issue.

1. Kindly confirm if .npmrc file is available in the root of your project.
2. Please make sure github_token in the workflow file has valid permission with respect to repository and also please confirm, in case if you use token different from secrets.GITHUB_TOKEN.
3. By default the package scope is set to the account that contains that workflow file. You have to use "scope" keyword to input if referring to other repositories. Please refer this Publish doc URL

Please feel free to share if any further clarifications needed.

Thanks!!

[CamJN]

Thanks for getting back to me, sorry my issue isn't reproducing for you, I know that's annoying.

1. I have no .npmrc file in my project at all, is one needed, is that documented anywhere?
2. The github.token is granted the write packages scope permission right in the workflow, as you can see here.
3. I am trying to publish the package to the account that owns the workflow file, so the default scope is acceptable.

As you can see from the logs I linked to in my report, npm tries to publish to https://registry.npmjs.org/ when I set the registry-url to https://npm.pkg.github.com/, so checking permissions isn't likely to help, as it's not trying to publish to github packages at all.

[shaanmugapriya]

Hello @CamJN, Thank you for an update!!

Thank you once again for letting us know, that .npmrc file is not available at project level.

Could you please try to run the npm.yml workflow by adding below code snippets at publish-gpr step before npm publish step in npm.yml file.

  - run: |
       echo registry=https://npm.pkg.github.com/ > .npmrc
       echo always-auth=true >> .npmrc
       echo _authToken=${{ secrets.GH_PAT }} >> .npmrc 

Kindly refer the URL to refer the details about .npmrc file

[CamJN]

Per that same page you linked to: https://github.com/actions/setup-node/blob/main/docs/advanced-usage.md#publish-to-npmjs-and-gpr-with-npm it should not be necessary to create an npmrc file, just run this action then publish. In fact the section on yarn2 (which I do not use but am simply quoting from) says that the setup-node action creates an npmrc file, but that doesn't seem to happen, I tried to cat the file and it doesn't seem to exist, perhaps I looked at the wrong path.

In my testing the auth line needs to be: echo //npm.pkg.github.com/:_authToken=${{ github.token }} >> .npmrc, the line you quoted gets this error:

npm ERR! code ERR_INVALID_AUTH
npm ERR! Invalid auth configuration found: `_authToken` must be renamed to `//npm.pkg.github.com/:_authToken` in project config
npm ERR! Please run `npm config fix` to repair your configuration.`

npm ERR! A complete log of this run can be found in: /Users/runner/.npm/_logs/2024-01-08T14_09_00_619Z-debug-0.log
Error: Process completed with exit code 1.

[shaanmugapriya]

Hello @CamJN, Thank you for an update!!

I believe the below code snippet is causing an issue.

echo //npm.pkg.github.com/:_authToken=${{ github.token }} >> .npmrc

Try to add below code snippet instead of above.

echo _authToken=${{ secrets.GH_PAT }} >> .npmrc

Kindly try to rerun the workflow after making above change. Also, make sure the github.token is available and has the appropriate permissions needed for publishing to GitHub Packages.

[CamJN]

I am sorry I wasn't clear.

echo _authToken=${{ secrets.GH_PAT }} >> .npmrc causes the issue, and echo //npm.pkg.github.com/:_authToken=${{ github.token }} >> .npmrc fixes it. So you may want to update the action to check the npm version and use the correct format when generating the .npmrc file.

Further, I have the workflow working at this point, though this action does seem to be broken, since I have to setup auth to the repo manually when this action is supposed to do so.

I've looked at the action's code and it prefers to put the .npmrc file in process.env['RUNNER_TEMP'] and then sets NPM_CONFIG_USERCONFIG to point npm at the file. However according to this issue, that env var will not be respected by npm when running the npm publish (or any other) script.

[aparnajyothi-y]

Hello @CamJN, Thank you for the information and confirmation that the workflow is working from your end.

Apologies for the delay in the response to provide the information about the current implementation of the setup-node.

The current implementation of setup-node is .npmrc file is created in the runner and set the the file location to NPM_CONFIG_USERCONFIG and should make sure that NPM token is properly configured (for automation primarily) and that it has been added as a repository secret in the repo's settings. please find the below code snippet that explains the functionality.

export function configAuthentication(registryUrl: string, alwaysAuth: string) {
const npmrc: string = path.resolve(
process.env['RUNNER_TEMP'] || process.cwd(),
'.npmrc'
);
if (!registryUrl.endsWith('/')) {
registryUrl += '/';
}

writeRegistryToFile(registryUrl, npmrc, alwaysAuth);
}

onst authString: string =
registryUrl.replace(/(^\w+:|^)/, '') + ':_authToken=${NODE_AUTH_TOKEN}';
const registryString = ${scope}registry=${registryUrl};
const alwaysAuthString = always-auth=${alwaysAuth};
newContents += ${authString}${os.EOL}${registryString}${os.EOL}${alwaysAuthString};
fs.writeFileSync(fileLocation, newContents);
core.exportVariable('NPM_CONFIG_USERCONFIG', fileLocation);
// Export empty node_auth_token if didn't exist so npm doesn't complain about not being able to find it
core.exportVariable(
'NODE_AUTH_TOKEN',
process.env.NODE_AUTH_TOKEN || 'XXXXX-XXXXX-XXXXX-XXXXX'
);

The below command will fix the issue as a workaround.
run: |
echo '//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}' > ${{ github.workspace }}/.npmrc
cat .npmrc

If you're experiencing any further issues related to this one or any other (or if the information current implementation solve this one for you), please feel free to reach out to reopen the issue.
Once again, I apologize for the late response and thank you very much for your cooperation and updates :)