@anolilab/semantic-release-pnpm 3.0.0-alpha.1 → 3.0.0-alpha.2

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## @anolilab/semantic-release-pnpm [3.0.0-alpha.2](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.0.0-alpha.1...@anolilab/semantic-release-pnpm@3.0.0-alpha.2) (2025-10-21)
+
+### Features
+
+* enhance npm authentication and trusted publishing support ([ccd056a](https://github.com/anolilab/semantic-release/commit/ccd056a02432b988fdcc79401d71182a433c4e97))
+* update dependencies in pnpm-lock.yaml and pnpm-workspace.yaml ([001fd47](https://github.com/anolilab/semantic-release/commit/001fd4722fa6ba02c4d9479522ee2cb6f3d4067e))
+
+### Bug Fixes
+
+* update package manager and dependencies across multiple configurations ([07a4e0b](https://github.com/anolilab/semantic-release/commit/07a4e0be0c8ba0b8fc79f5d922bb62f60db38350))
+
+
+### Dependencies
+
+* **@anolilab/rc:** upgraded to 3.0.0-alpha.2
+
 ## @anolilab/semantic-release-pnpm [3.0.0-alpha.1](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@2.0.4...@anolilab/semantic-release-pnpm@3.0.0-alpha.1) (2025-10-14)
 
 ### ⚠ BREAKING CHANGES

package/README.md

@@ -62,29 +62,28 @@ The plugin can be configured in the [**semantic-release** configuration file](ht
 
 ### npm registry authentication
 
-The npm [token](https://docs.npmjs.com/about-access-tokens) authentication configuration is **required** and can be set via [environment variables](#environment-variables).
+#### Official Registry
 
-Automation tokens are recommended since they can be used for an automated workflow, even when your account is configured to use the [`auth-and-writes` level of 2FA](https://docs.npmjs.com/about-two-factor-authentication#authorization-and-writes).
+When publishing to the [official registry](https://registry.npmjs.org/), it is recommended to publish with authentication intended for automation:
 
-### npm provenance
-
-If you are publishing to the official registry and your pipeline is on a [provider that is supported by npm for provenance](https://docs.npmjs.com/generating-provenance-statements#provenance-limitations), npm can be configured to [publish with provenance](https://docs.npmjs.com/generating-provenance-statements).
+- For improved security, and since access tokens have recently had their [maximum lifetimes restricted](https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/),
+  [trusted publishing](https://docs.npmjs.com/trusted-publishers) is recommended when publishing from a [supported CI provider](https://docs.npmjs.com/trusted-publishers#supported-cicd-providers)
+- [Granular access tokens](https://docs.npmjs.com/creating-and-viewing-access-tokens#creating-granular-access-tokens-on-the-website) are recommended when publishing from a CI provider that is not supported by npm for trusted publishing, and can be set via [environment variables](#environment-variables).
+  Because these access tokens expire, rotation will need to be accounted for in this scenario.
 
-Since semantic-release wraps the npm publish command, configuring provenance is not exposed directly.
-Instead, provenance can be configured through the [other configuration options exposed by npm](https://docs.npmjs.com/generating-provenance-statements#using-third-party-package-publishing-tools).
-Provenance applies specifically to publishing, so our recommendation is to configure under `publishConfig` within the `package.json`.
+> [!NOTE]
+> When using trusted publishing, provenance attestations are automatically generated for your packages without requiring provenance to be explicitly enabled.
 
-#### npm provenance on GitHub Actions
+##### Trusted publishing from GitHub Actions
 
-For package provenance to be signed on the GitHub Actions CI the following permission is required
-to be enabled on the job:
+To leverage trusted publishing and publish with provenance from GitHub Actions, the `id-token: write` permission is required to be enabled on the job:
 
 ```yaml
 permissions:
-    id-token: write # to enable use of OIDC for npm provenance
+    id-token: write # to enable use of OIDC for trusted publishing and npm provenance
 ```
 
-It's worth noting that if you are using semantic-release to its fullest with a GitHub release, GitHub comments,
+It's also worth noting that if you are using semantic-release to its fullest with a GitHub release, GitHub comments,
 and other features, then [more permissions are required](https://github.com/semantic-release/github#github-authentication) to be enabled on this job:
 
 ```yaml
@@ -92,11 +91,51 @@ permissions:
     contents: write # to be able to publish a GitHub release
     issues: write # to be able to comment on released issues
     pull-requests: write # to be able to comment on released pull requests
-    id-token: write # to enable use of OIDC for npm provenance
+    id-token: write # to enable use of OIDC for trusted publishing and npm provenance
 ```
 
 Refer to the [GitHub Actions recipe for npm package provenance](https://semantic-release.gitbook.io/semantic-release/recipes/ci-configurations/github-actions#.github-workflows-release.yml-configuration-for-node-projects) for the full CI job's YAML code example.
 
+##### Trusted publishing for GitLab Pipelines
+
+To leverage trusted publishing and publish with provenance from GitLab Pipelines, `NPM_ID_TOKEN` needs to be added as an entry under `id_tokens` in the job definition with an audience of `npm:registry.npmjs.org`:
+
+```yaml
+id_tokens:
+    NPM_ID_TOKEN:
+        aud: "npm:registry.npmjs.org"
+```
+
+See the [npm documentation for more details about configuring pipeline details](https://docs.npmjs.com/trusted-publishers#gitlab-cicd-configuration)
+
+##### Unsupported CI providers
+
+Token authentication is **required** and can be set via [environment variables](#environment-variables).
+[Granular access tokens](https://docs.npmjs.com/creating-and-viewing-access-tokens#creating-granular-access-tokens-on-the-website) are recommended in this scenario, since trusted publishing is not available from all CI providers.
+Because these access tokens expire, rotation will need to be accounted for in your process.
+
+#### Alternative Registries
+
+Token authentication is **required** and can be set via [environment variables](#environment-variables).
+See the documentation for your registry for details on how to create a token for automation.
+
+### npm provenance
+
+When using trusted publishing to the official npm registry, provenance attestations are automatically generated for your packages without requiring provenance to be explicitly enabled.
+
+For alternative registries or when using token-based authentication, provenance can be configured through the [other configuration options exposed by npm](https://docs.npmjs.com/generating-provenance-statements#using-third-party-package-publishing-tools).
+Provenance applies specifically to publishing, so configure it under `publishConfig` within the `package.json`:
+
+```json
+{
+    "publishConfig": {
+        "registry": "https://registry.npmjs.org/",
+        "tag": "latest",
+        "provenance": true
+    }
+}
+```
+
 ### Environment variables
 
 | Variable    | Description                                                                                                                   |

package/dist/index.js

@@ -27,6 +27,7 @@ import { rc } from '@anolilab/rc';
 import normalizeUrl from 'normalize-url';
 import { findPackageJson, getPackageManagerVersion } from '@visulima/package';
 import SemanticReleaseError from '@semantic-release/error';
+import envCi from 'env-ci';
 const {
   stringify
 } = __cjs_require("ini");
@@ -57,10 +58,12 @@ const getNpmrcPath = (cwd, environment) => {
   return npmrcPath;
 };
 
-const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org/";
+const OFFICIAL_REGISTRY = "https://registry.npmjs.org/";
+const GITHUB_ACTIONS_PROVIDER_NAME = "GitHub Actions";
+const GITLAB_PIPELINES_PROVIDER_NAME = "GitLab CI/CD";
 
 const getRegistryUrl = (scope, npmrc) => {
-  let url = DEFAULT_NPM_REGISTRY;
+  let url = OFFICIAL_REGISTRY;
   if (npmrc) {
     const registryUrl = npmrc[`${scope}:registry`] ?? npmrc.registry;
     if (registryUrl) {
@@ -74,11 +77,11 @@ const getRegistry = ({ name, publishConfig: { registry } = {} }, { cwd, env }) =
   rc("npm", {
     config: env.NPM_CONFIG_USERCONFIG ?? resolve(cwd, ".npmrc"),
     cwd,
-    defaults: { registry: "https://registry.npmjs.org/" }
+    defaults: { registry: OFFICIAL_REGISTRY }
   }).config
 );
 
-const getReleaseInfo = ({ name }, { env: { DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org/" }, nextRelease: { version } }, distributionTag, registry) => {
+const getReleaseInfo = ({ name }, { env: { DEFAULT_NPM_REGISTRY = OFFICIAL_REGISTRY }, nextRelease: { version } }, distributionTag, registry) => {
   return {
     channel: distributionTag,
     name: `pnpm package (@${distributionTag} dist-tag)`,
@@ -211,6 +214,15 @@ Your configuration for the \`branches\` option is \`${branches.join(",")}\`.`,
       message: "Invalid `branches` option."
     };
   },
+  EINVALIDNPMAUTH: ({ registry }) => {
+    return {
+      details: `The [authentication required to publish](${linkify(
+        "README.md#npm-registry-authentication"
+      )}) configured in the \`NPM_TOKEN\` environment variable must be a valid [token](https://docs.npmjs.com/getting-started/working_with_tokens) allowed to publish to the registry \`${String(registry)}\`.
+Please make sure to set the \`NPM_TOKEN\` environment variable in your CI with the exact value of the npm token.`,
+      message: "Invalid npm authentication."
+    };
+  },
   EINVALIDNPMPUBLISH: ({ npmPublish }) => {
     return {
       details: `The [npmPublish option](${linkify("README.md#npmpublish")}) option, if defined, must be a \`Boolean\`.
@@ -223,8 +235,7 @@ Your configuration for the \`npmPublish\` option is \`${String(npmPublish)}\`.`,
       details: `The [npm token](${linkify(
         "README.md#npm-registry-authentication"
       )}) configured in the \`NPM_TOKEN\` environment variable must be a valid [token](https://docs.npmjs.com/getting-started/working_with_tokens) allowing to publish to the registry \`${String(registry)}\`.
-If you are using Two Factor Authentication for your account, set its level to ["Authorization only"](https://docs.npmjs.com/getting-started/using-two-factor-authentication#levels-of-authentication) in your account settings. **semantic-release** cannot publish with the default "Authorization and writes" level.
-Please make sure to set the \`NPM_TOKEN\` environment variable in your CI with the exact value of the npm token.`,
+Please verify your authentication configuration.`,
       message: "Invalid npm token."
     };
   },
@@ -261,10 +272,10 @@ Your configuration for the \`tarballDir\` option is \`${String(tarballDir)}\`.`,
   },
   ENONPMTOKEN: ({ registry }) => {
     return {
-      details: `An [npm token](${linkify(
+      details: `When not publishing through [trusted publishing](https://docs.npmjs.com/trusted-publishers), an [npm token](${linkify(
         "README.md#npm-registry-authentication"
       )}) must be created and set in the \`NPM_TOKEN\` environment variable on your CI environment.
-Please make sure to create an [npm token](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens) and to set it in the \`NPM_TOKEN\` environment variable on your CI environment. The token must allow to publish to the registry \`${String(registry)}\`.`,
+Please make sure to create an [npm token](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens) and set it in the \`NPM_TOKEN\` environment variable on your CI environment. The token must allow publishing to the registry \`${registry}\`.`,
       message: "No npm token specified."
     };
   },
@@ -318,6 +329,66 @@ const getPackage = async ({ pkgRoot }, { cwd }) => {
   }
 };
 
+const exchangeIdToken = async (idToken, packageName, logger) => {
+  const response = await fetch(`${OFFICIAL_REGISTRY}-/npm/v1/oidc/token/exchange/package/${encodeURIComponent(packageName)}`, {
+    headers: { Authorization: `Bearer ${idToken}` },
+    method: "POST"
+  });
+  const responseBody = await response.json();
+  if (response.ok) {
+    logger.log("OIDC token exchange with the npm registry succeeded");
+    return responseBody.token;
+  }
+  logger.log(`OIDC token exchange with the npm registry failed: ${response.status} ${responseBody.message}`);
+  return void 0;
+};
+const exchangeGithubActionsToken = async (packageName, logger) => {
+  let idToken;
+  logger.log("Verifying OIDC context for publishing from GitHub Actions");
+  try {
+    const { getIDToken } = await import('@actions/core');
+    idToken = await getIDToken("npm:registry.npmjs.org");
+  } catch (error) {
+    logger.log(`Retrieval of GitHub Actions OIDC token failed: ${error.message}`);
+    logger.log("Have you granted the `id-token: write` permission to this workflow?");
+    return void 0;
+  }
+  if (!idToken) {
+    return void 0;
+  }
+  return exchangeIdToken(idToken, packageName, logger);
+};
+const exchangeGitlabPipelinesToken = async (packageName, logger) => {
+  const idToken = process.env.NPM_ID_TOKEN;
+  logger.log("Verifying OIDC context for publishing from GitLab Pipelines");
+  if (!idToken) {
+    return void 0;
+  }
+  return exchangeIdToken(idToken, packageName, logger);
+};
+const tokenExchange = (pkg, { logger }) => {
+  const { name: ciProviderName } = envCi();
+  if (GITHUB_ACTIONS_PROVIDER_NAME === ciProviderName) {
+    return exchangeGithubActionsToken(pkg.name, logger);
+  }
+  if (GITLAB_PIPELINES_PROVIDER_NAME === ciProviderName) {
+    return exchangeGitlabPipelinesToken(pkg.name, logger);
+  }
+  return Promise.resolve(void 0);
+};
+
+const oidcContext = async (registry, pkg, context) => {
+  if (OFFICIAL_REGISTRY !== registry) {
+    return false;
+  }
+  try {
+    const token = await tokenExchange({ name: pkg.name ?? "" }, context);
+    return !!token;
+  } catch {
+    return false;
+  }
+};
+
 const nerfDart = (url) => {
   const parsed = new URL(url);
   const from = `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
@@ -330,7 +401,7 @@ const setNpmrcAuth = async (npmrc, registry, { cwd, env: { NPM_CONFIG_USERCONFIG
   const { config, files } = rc("npm", {
     config: NPM_CONFIG_USERCONFIG ?? resolve(cwd, ".npmrc"),
     cwd,
-    defaults: { registry: DEFAULT_NPM_REGISTRY }
+    defaults: { registry: OFFICIAL_REGISTRY }
   });
   if (Array.isArray(files)) {
     logger.log("Reading npm config from %s", files.join(", "));
@@ -354,33 +425,43 @@ email = \${NPM_EMAIL}`);
   }
 };
 
-const verifyAuth = async (npmrc, package_, context) => {
+const verifyAuthContextAgainstRegistry = async (npmrc, registry, context) => {
   const {
     cwd,
-    env: { DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org/", ...environment },
+    env: { ...environment },
     logger,
     stderr,
     stdout
   } = context;
+  try {
+    logger.log(`Running "pnpm whoami" to verify authentication on registry "${registry}"`);
+    const whoamiResult = await execa("pnpm", ["whoami", "--userconfig", npmrc, "--registry", registry], {
+      cwd,
+      env: environment,
+      preferLocal: true
+    });
+    if (whoamiResult.stdout) {
+      stdout.write(whoamiResult.stdout);
+    }
+    if (whoamiResult.stderr) {
+      stderr.write(whoamiResult.stderr);
+    }
+  } catch {
+    const semanticError = getError("EINVALIDNPMTOKEN", { registry });
+    throw new AggregateError([semanticError], semanticError.message);
+  }
+};
+const verifyAuth = async (npmrc, package_, context, pkgRoot) => {
   const registry = getRegistry(package_, context);
+  if (package_.name && await oidcContext(registry, package_, context)) {
+    return;
+  }
   await setNpmrcAuth(npmrc, registry, context);
+  const {
+    env: { DEFAULT_NPM_REGISTRY = OFFICIAL_REGISTRY }
+  } = context;
   if (normalizeUrl(registry) === normalizeUrl(DEFAULT_NPM_REGISTRY)) {
-    try {
-      logger.log(`Running "pnpm whoami" to verify authentication on registry "${registry}"`);
-      const whoamiResult = execa("pnpm", ["whoami", "--userconfig", npmrc, "--registry", registry], {
-        cwd,
-        env: environment,
-        preferLocal: true
-      });
-      whoamiResult.stdout.pipe(stdout, { end: false });
-      whoamiResult.stderr.pipe(stderr, { end: false });
-      await whoamiResult;
-    } catch {
-      const semanticError = getError("EINVALIDNPMTOKEN", { registry });
-      throw new AggregateError([semanticError], semanticError.message);
-    }
-  } else {
-    logger.log(`Skipping authentication verification for non-default registry "${registry}"`);
+    await verifyAuthContextAgainstRegistry(npmrc, registry, context);
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anolilab/semantic-release-pnpm",
-  "version": "3.0.0-alpha.1",
+  "version": "3.0.0-alpha.2",
   "description": "Semantic-release plugin to publish a npm package with pnpm.",
   "keywords": [
     "anolilab",
@@ -46,11 +46,13 @@
     "dist"
   ],
   "dependencies": {
-    "@anolilab/rc": "3.0.0-alpha.1",
+    "@actions/core": "^1.11.1",
+    "@anolilab/rc": "3.0.0-alpha.2",
     "@semantic-release/error": "^4.0.0",
-    "@visulima/fs": "^3.1.9",
-    "@visulima/package": "^4.0.2",
-    "@visulima/path": "^1.4.0",
+    "@visulima/fs": "^4.0.2",
+    "@visulima/package": "^4.1.2",
+    "@visulima/path": "^2.0.1",
+    "env-ci": "^11.2.0",
     "execa": "^9.6.0",
     "ini": "^5.0.0",
     "normalize-url": "^8.1.0",