@anolilab/semantic-release-pnpm 3.0.0-alpha.1 → 3.0.0-alpha.3

package/CHANGELOG.md

@@ -1,3 +1,45 @@
+## @anolilab/semantic-release-pnpm [3.0.0-alpha.3](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.0.0-alpha.2...@anolilab/semantic-release-pnpm@3.0.0-alpha.3) (2025-11-20)
+
+### Bug Fixes
+
+* enhance integration and unit tests for npm authentication ([79ae50d](https://github.com/anolilab/semantic-release/commit/79ae50d47362159a426d31acc9432ba3ac31993e))
+* update package dependencies and configurations ([fed735c](https://github.com/anolilab/semantic-release/commit/fed735c729647a595d587eaa162d2c44ff9948f1))
+
+### Miscellaneous Chores
+
+* add '@types/env-ci' dependency and refine type handling ([f897d6c](https://github.com/anolilab/semantic-release/commit/f897d6c26436790504bcb8ca98095e4ab3f2bd61))
+* update '@actions/core' dependency in semantic-release-pnpm ([50cc6e0](https://github.com/anolilab/semantic-release/commit/50cc6e09e2d1959acdcfc6475c1ecfbcb0fdb406))
+* update '@actions/core' dependency to production in pnpm configuration ([bfec287](https://github.com/anolilab/semantic-release/commit/bfec287c74f048f41bcb0517353d3d4dede451a0))
+* update Node.js version and refine dependencies in pnpm-workspace ([cbd6172](https://github.com/anolilab/semantic-release/commit/cbd617234ac6e5f5a14b70fbf6d6aec3bcd38fe0))
+
+### Code Refactoring
+
+* clean up whitespace and comments in get-config.ts and verify-auth.ts ([26dc037](https://github.com/anolilab/semantic-release/commit/26dc037917f281f24d096d9790b671262f432b24))
+* enhance inline plugin creator with consistent git root handling ([4ebaea4](https://github.com/anolilab/semantic-release/commit/4ebaea46d35bb89a0adcb4bf58c6df559e35f107))
+* Ensure consistent cwd handling across all plugin hooks ([3028b71](https://github.com/anolilab/semantic-release/commit/3028b71f6f16244968bd6646b042ac893ffa5bb9))
+* update test cases and improve type handling ([328c392](https://github.com/anolilab/semantic-release/commit/328c39278c609fd9169df79f3f48bbd8038d2e64))
+
+
+### Dependencies
+
+* **@anolilab/rc:** upgraded to 3.0.0-alpha.3
+
+## @anolilab/semantic-release-pnpm [3.0.0-alpha.2](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.0.0-alpha.1...@anolilab/semantic-release-pnpm@3.0.0-alpha.2) (2025-10-21)
+
+### Features
+
+* enhance npm authentication and trusted publishing support ([ccd056a](https://github.com/anolilab/semantic-release/commit/ccd056a02432b988fdcc79401d71182a433c4e97))
+* update dependencies in pnpm-lock.yaml and pnpm-workspace.yaml ([001fd47](https://github.com/anolilab/semantic-release/commit/001fd4722fa6ba02c4d9479522ee2cb6f3d4067e))
+
+### Bug Fixes
+
+* update package manager and dependencies across multiple configurations ([07a4e0b](https://github.com/anolilab/semantic-release/commit/07a4e0be0c8ba0b8fc79f5d922bb62f60db38350))
+
+
+### Dependencies
+
+* **@anolilab/rc:** upgraded to 3.0.0-alpha.2
+
 ## @anolilab/semantic-release-pnpm [3.0.0-alpha.1](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@2.0.4...@anolilab/semantic-release-pnpm@3.0.0-alpha.1) (2025-10-14)
 
 ### ⚠ BREAKING CHANGES
@@ -15,6 +57,17 @@
 
 * **@anolilab/rc:** upgraded to 3.0.0-alpha.1
 
+## @anolilab/semantic-release-pnpm [2.0.5](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@2.0.4...@anolilab/semantic-release-pnpm@2.0.5) (2025-11-01)
+
+### Bug Fixes
+
+* update package dependencies and configurations ([d94ebd8](https://github.com/anolilab/semantic-release/commit/d94ebd8869c34106aa0c11beb0f7410bbc86367f))
+
+
+### Dependencies
+
+* **@anolilab/rc:** upgraded to 2.0.5
+
 ## @anolilab/semantic-release-pnpm [2.0.4](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@2.0.3...@anolilab/semantic-release-pnpm@2.0.4) (2025-09-22)
 
 ### Bug Fixes

package/README.md

@@ -62,29 +62,28 @@ The plugin can be configured in the [**semantic-release** configuration file](ht
 
 ### npm registry authentication
 
-The npm [token](https://docs.npmjs.com/about-access-tokens) authentication configuration is **required** and can be set via [environment variables](#environment-variables).
+#### Official Registry
 
-Automation tokens are recommended since they can be used for an automated workflow, even when your account is configured to use the [`auth-and-writes` level of 2FA](https://docs.npmjs.com/about-two-factor-authentication#authorization-and-writes).
+When publishing to the [official registry](https://registry.npmjs.org/), it is recommended to publish with authentication intended for automation:
 
-### npm provenance
-
-If you are publishing to the official registry and your pipeline is on a [provider that is supported by npm for provenance](https://docs.npmjs.com/generating-provenance-statements#provenance-limitations), npm can be configured to [publish with provenance](https://docs.npmjs.com/generating-provenance-statements).
+- For improved security, and since access tokens have recently had their [maximum lifetimes restricted](https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/),
+  [trusted publishing](https://docs.npmjs.com/trusted-publishers) is recommended when publishing from a [supported CI provider](https://docs.npmjs.com/trusted-publishers#supported-cicd-providers)
+- [Granular access tokens](https://docs.npmjs.com/creating-and-viewing-access-tokens#creating-granular-access-tokens-on-the-website) are recommended when publishing from a CI provider that is not supported by npm for trusted publishing, and can be set via [environment variables](#environment-variables).
+  Because these access tokens expire, rotation will need to be accounted for in this scenario.
 
-Since semantic-release wraps the npm publish command, configuring provenance is not exposed directly.
-Instead, provenance can be configured through the [other configuration options exposed by npm](https://docs.npmjs.com/generating-provenance-statements#using-third-party-package-publishing-tools).
-Provenance applies specifically to publishing, so our recommendation is to configure under `publishConfig` within the `package.json`.
+> [!NOTE]
+> When using trusted publishing, provenance attestations are automatically generated for your packages without requiring provenance to be explicitly enabled.
 
-#### npm provenance on GitHub Actions
+##### Trusted publishing from GitHub Actions
 
-For package provenance to be signed on the GitHub Actions CI the following permission is required
-to be enabled on the job:
+To leverage trusted publishing and publish with provenance from GitHub Actions, the `id-token: write` permission is required to be enabled on the job:
 
 ```yaml
 permissions:
-    id-token: write # to enable use of OIDC for npm provenance
+    id-token: write # to enable use of OIDC for trusted publishing and npm provenance
 ```
 
-It's worth noting that if you are using semantic-release to its fullest with a GitHub release, GitHub comments,
+It's also worth noting that if you are using semantic-release to its fullest with a GitHub release, GitHub comments,
 and other features, then [more permissions are required](https://github.com/semantic-release/github#github-authentication) to be enabled on this job:
 
 ```yaml
@@ -92,11 +91,51 @@ permissions:
     contents: write # to be able to publish a GitHub release
     issues: write # to be able to comment on released issues
     pull-requests: write # to be able to comment on released pull requests
-    id-token: write # to enable use of OIDC for npm provenance
+    id-token: write # to enable use of OIDC for trusted publishing and npm provenance
 ```
 
 Refer to the [GitHub Actions recipe for npm package provenance](https://semantic-release.gitbook.io/semantic-release/recipes/ci-configurations/github-actions#.github-workflows-release.yml-configuration-for-node-projects) for the full CI job's YAML code example.
 
+##### Trusted publishing for GitLab Pipelines
+
+To leverage trusted publishing and publish with provenance from GitLab Pipelines, `NPM_ID_TOKEN` needs to be added as an entry under `id_tokens` in the job definition with an audience of `npm:registry.npmjs.org`:
+
+```yaml
+id_tokens:
+    NPM_ID_TOKEN:
+        aud: "npm:registry.npmjs.org"
+```
+
+See the [npm documentation for more details about configuring pipeline details](https://docs.npmjs.com/trusted-publishers#gitlab-cicd-configuration)
+
+##### Unsupported CI providers
+
+Token authentication is **required** and can be set via [environment variables](#environment-variables).
+[Granular access tokens](https://docs.npmjs.com/creating-and-viewing-access-tokens#creating-granular-access-tokens-on-the-website) are recommended in this scenario, since trusted publishing is not available from all CI providers.
+Because these access tokens expire, rotation will need to be accounted for in your process.
+
+#### Alternative Registries
+
+Token authentication is **required** and can be set via [environment variables](#environment-variables).
+See the documentation for your registry for details on how to create a token for automation.
+
+### npm provenance
+
+When using trusted publishing to the official npm registry, provenance attestations are automatically generated for your packages without requiring provenance to be explicitly enabled.
+
+For alternative registries or when using token-based authentication, provenance can be configured through the [other configuration options exposed by npm](https://docs.npmjs.com/generating-provenance-statements#using-third-party-package-publishing-tools).
+Provenance applies specifically to publishing, so configure it under `publishConfig` within the `package.json`:
+
+```json
+{
+    "publishConfig": {
+        "registry": "https://registry.npmjs.org/",
+        "tag": "latest",
+        "provenance": true
+    }
+}
+```
+
 ### Environment variables
 
 | Variable    | Description                                                                                                                   |

package/dist/index.js

@@ -1,36 +1,33 @@
 import { createRequire as __cjs_createRequire } from "node:module";
+
 const __cjs_require = __cjs_createRequire(import.meta.url);
 
-// Runtime capability helpers
+const __cjs_getProcess = typeof globalThis !== "undefined" && typeof globalThis.process !== "undefined" ? globalThis.process : process;
+
 const __cjs_getBuiltinModule = (module) => {
     // Check if we're in Node.js and version supports getBuiltinModule
-    if ("object" !== "undefined" && process.versions?.node) {
-        const [major, minor] = process.versions.node.split(".").map(Number);
+    if (typeof __cjs_getProcess !== "undefined" && __cjs_getProcess.versions && __cjs_getProcess.versions.node) {
+        const [major, minor] = __cjs_getProcess.versions.node.split(".").map(Number);
         // Node.js 20.16.0+ and 22.3.0+
         if (major > 22 || (major === 22 && minor >= 3) || (major === 20 && minor >= 16)) {
-            return process.getBuiltinModule(module);
+            return __cjs_getProcess.getBuiltinModule(module);
         }
     }
     // Fallback to createRequire
     return __cjs_require(module);
 };
 
-const __cjs_getProcess = typeof globalThis !== "undefined" && typeof globalThis.process !== "undefined" ? globalThis.process : process;
 import { execa } from 'execa';
-const {
-  validRange,
-  gte
-} = __cjs_require("semver");
+import { validRange, gte } from 'semver';
 import { isAccessibleSync, ensureFileSync, move, writeFile } from '@visulima/fs';
 import { resolve } from '@visulima/path';
 import { rc } from '@anolilab/rc';
 import normalizeUrl from 'normalize-url';
 import { findPackageJson, getPackageManagerVersion } from '@visulima/package';
 import SemanticReleaseError from '@semantic-release/error';
-const {
-  stringify
-} = __cjs_require("ini");
-const getAuthToken = __cjs_require("registry-auth-token");
+import envCi from 'env-ci';
+import { stringify } from 'ini';
+import getAuthToken from 'registry-auth-token';
 const {
   URL
 } = __cjs_getBuiltinModule("node:url");
@@ -57,10 +54,12 @@ const getNpmrcPath = (cwd, environment) => {
   return npmrcPath;
 };
 
-const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org/";
+const OFFICIAL_REGISTRY = "https://registry.npmjs.org/";
+const GITHUB_ACTIONS_PROVIDER_NAME = "GitHub Actions";
+const GITLAB_PIPELINES_PROVIDER_NAME = "GitLab CI/CD";
 
 const getRegistryUrl = (scope, npmrc) => {
-  let url = DEFAULT_NPM_REGISTRY;
+  let url = OFFICIAL_REGISTRY;
   if (npmrc) {
     const registryUrl = npmrc[`${scope}:registry`] ?? npmrc.registry;
     if (registryUrl) {
@@ -74,11 +73,11 @@ const getRegistry = ({ name, publishConfig: { registry } = {} }, { cwd, env }) =
   rc("npm", {
     config: env.NPM_CONFIG_USERCONFIG ?? resolve(cwd, ".npmrc"),
     cwd,
-    defaults: { registry: "https://registry.npmjs.org/" }
+    defaults: { registry: OFFICIAL_REGISTRY }
   }).config
 );
 
-const getReleaseInfo = ({ name }, { env: { DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org/" }, nextRelease: { version } }, distributionTag, registry) => {
+const getReleaseInfo = ({ name }, { env: { DEFAULT_NPM_REGISTRY = OFFICIAL_REGISTRY }, nextRelease: { version } }, distributionTag, registry) => {
   return {
     channel: distributionTag,
     name: `pnpm package (@${distributionTag} dist-tag)`,
@@ -111,9 +110,12 @@ const addChannel$1 = async (pluginConfig, packageJson, context) => {
     const distributionTag = getChannel(channel);
     logger.log(`Adding version ${version} to npm registry on dist-tag ${distributionTag}`);
     const npmrc = getNpmrcPath(cwd, env);
-    const result = execa("pnpm", ["dist-tag", "add", `${packageJson.name}@${version}`, distributionTag, "--userconfig", npmrc, "--registry", registry], {
+    const result = execa("pnpm", ["dist-tag", "add", `${packageJson.name}@${version}`, distributionTag, "--registry", registry], {
       cwd,
-      env,
+      env: {
+        ...env,
+        NPM_CONFIG_USERCONFIG: npmrc
+      },
       preferLocal: true
     });
     result.stdout.pipe(stdout, { end: false });
@@ -198,7 +200,7 @@ const publish$1 = async (pluginConfig, packageJson, context) => {
   return false;
 };
 
-const homepage = "https://github.com/anolilab/semantic-release/tree/main/packages/semantic-release-pnpm";
+var homepage = "https://github.com/anolilab/semantic-release/tree/main/packages/semantic-release-pnpm";
 const packageJson = {
 	homepage: homepage};
 
@@ -211,6 +213,15 @@ Your configuration for the \`branches\` option is \`${branches.join(",")}\`.`,
       message: "Invalid `branches` option."
     };
   },
+  EINVALIDNPMAUTH: ({ registry }) => {
+    return {
+      details: `The [authentication required to publish](${linkify(
+        "README.md#npm-registry-authentication"
+      )}) configured in the \`NPM_TOKEN\` environment variable must be a valid [token](https://docs.npmjs.com/getting-started/working_with_tokens) allowed to publish to the registry \`${String(registry)}\`.
+Please make sure to set the \`NPM_TOKEN\` environment variable in your CI with the exact value of the npm token.`,
+      message: "Invalid npm authentication."
+    };
+  },
   EINVALIDNPMPUBLISH: ({ npmPublish }) => {
     return {
       details: `The [npmPublish option](${linkify("README.md#npmpublish")}) option, if defined, must be a \`Boolean\`.
@@ -223,8 +234,7 @@ Your configuration for the \`npmPublish\` option is \`${String(npmPublish)}\`.`,
       details: `The [npm token](${linkify(
         "README.md#npm-registry-authentication"
       )}) configured in the \`NPM_TOKEN\` environment variable must be a valid [token](https://docs.npmjs.com/getting-started/working_with_tokens) allowing to publish to the registry \`${String(registry)}\`.
-If you are using Two Factor Authentication for your account, set its level to ["Authorization only"](https://docs.npmjs.com/getting-started/using-two-factor-authentication#levels-of-authentication) in your account settings. **semantic-release** cannot publish with the default "Authorization and writes" level.
-Please make sure to set the \`NPM_TOKEN\` environment variable in your CI with the exact value of the npm token.`,
+Please verify your authentication configuration.`,
       message: "Invalid npm token."
     };
   },
@@ -261,10 +271,10 @@ Your configuration for the \`tarballDir\` option is \`${String(tarballDir)}\`.`,
   },
   ENONPMTOKEN: ({ registry }) => {
     return {
-      details: `An [npm token](${linkify(
+      details: `When not publishing through [trusted publishing](https://docs.npmjs.com/trusted-publishers), an [npm token](${linkify(
         "README.md#npm-registry-authentication"
       )}) must be created and set in the \`NPM_TOKEN\` environment variable on your CI environment.
-Please make sure to create an [npm token](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens) and to set it in the \`NPM_TOKEN\` environment variable on your CI environment. The token must allow to publish to the registry \`${String(registry)}\`.`,
+Please make sure to create an [npm token](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens) and set it in the \`NPM_TOKEN\` environment variable on your CI environment. The token must allow publishing to the registry \`${registry}\`.`,
       message: "No npm token specified."
     };
   },
@@ -318,6 +328,77 @@ const getPackage = async ({ pkgRoot }, { cwd }) => {
   }
 };
 
+const exchangeIdToken = async (idToken, packageName, logger) => {
+  const response = await fetch(`${OFFICIAL_REGISTRY}-/npm/v1/oidc/token/exchange/package/${encodeURIComponent(packageName)}`, {
+    headers: { Authorization: `Bearer ${idToken}` },
+    method: "POST"
+  });
+  const responseBody = await response.json();
+  if (response.ok) {
+    logger.log("OIDC token exchange with the npm registry succeeded");
+    return responseBody.token;
+  }
+  logger.log(`OIDC token exchange with the npm registry failed: ${response.status} ${responseBody.message}`);
+  return void 0;
+};
+const exchangeGithubActionsToken = async (packageName, logger) => {
+  let idToken;
+  logger.log("Verifying OIDC context for publishing from GitHub Actions");
+  try {
+    const { getIDToken } = await import('@actions/core');
+    idToken = await getIDToken("npm:registry.npmjs.org");
+  } catch (error) {
+    logger.log(`Retrieval of GitHub Actions OIDC token failed: ${error.message}`);
+    logger.log("Have you granted the `id-token: write` permission to this workflow?");
+    return void 0;
+  }
+  if (!idToken) {
+    logger.log("NPM_ID_TOKEN environment variable is not set");
+    logger.log("Configure trusted publishing in your GitLab project settings and set the NPM_ID_TOKEN variable");
+    return void 0;
+  }
+  return exchangeIdToken(idToken, packageName, logger);
+};
+const exchangeGitlabPipelinesToken = async (packageName, logger) => {
+  const idToken = process.env.NPM_ID_TOKEN;
+  logger.log("Verifying OIDC context for publishing from GitLab Pipelines");
+  if (!idToken) {
+    return void 0;
+  }
+  return exchangeIdToken(idToken, packageName, logger);
+};
+const tokenExchange = (pkg, { logger }) => {
+  if (!pkg.name || typeof pkg.name !== "string" || pkg.name.trim() === "") {
+    logger.log("Invalid package name provided for OIDC token exchange");
+    return Promise.resolve(void 0);
+  }
+  const ciEnv = envCi();
+  const ciProviderName = typeof ciEnv === "object" && ciEnv !== null && typeof ciEnv.name === "string" ? ciEnv.name : void 0;
+  if (!ciProviderName) {
+    logger.log("Unable to detect CI provider for OIDC token exchange");
+    return Promise.resolve(void 0);
+  }
+  if (GITHUB_ACTIONS_PROVIDER_NAME === ciProviderName) {
+    return exchangeGithubActionsToken(pkg.name, logger);
+  }
+  if (GITLAB_PIPELINES_PROVIDER_NAME === ciProviderName) {
+    return exchangeGitlabPipelinesToken(pkg.name, logger);
+  }
+  return Promise.resolve(void 0);
+};
+
+const oidcContext = async (registry, pkg, context) => {
+  if (OFFICIAL_REGISTRY !== registry) {
+    return false;
+  }
+  try {
+    const token = await tokenExchange({ name: pkg.name ?? "" }, context);
+    return !!token;
+  } catch {
+    return false;
+  }
+};
+
 const nerfDart = (url) => {
   const parsed = new URL(url);
   const from = `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
@@ -330,7 +411,7 @@ const setNpmrcAuth = async (npmrc, registry, { cwd, env: { NPM_CONFIG_USERCONFIG
   const { config, files } = rc("npm", {
     config: NPM_CONFIG_USERCONFIG ?? resolve(cwd, ".npmrc"),
     cwd,
-    defaults: { registry: DEFAULT_NPM_REGISTRY }
+    defaults: { registry: OFFICIAL_REGISTRY }
   });
   if (Array.isArray(files)) {
     logger.log("Reading npm config from %s", files.join(", "));
@@ -340,9 +421,12 @@ const setNpmrcAuth = async (npmrc, registry, { cwd, env: { NPM_CONFIG_USERCONFIG
     return;
   }
   if (NPM_USERNAME && NPM_PASSWORD && NPM_EMAIL) {
-    await writeFile(npmrc, `${Object.keys(config).length > 0 ? `${stringify(config)}
-` : ""}_auth = \${LEGACY_TOKEN}
-email = \${NPM_EMAIL}`);
+    await writeFile(
+      npmrc,
+      `${Object.keys(config).length > 0 ? `${stringify(config)}
+` : ""}${nerfDart(registry)}:_auth = \${LEGACY_TOKEN}
+email = \${NPM_EMAIL}`
+    );
     logger.log(`Wrote NPM_USERNAME, NPM_PASSWORD, and NPM_EMAIL to ${npmrc}`);
   } else if (NPM_TOKEN) {
     await writeFile(npmrc, `${Object.keys(config).length > 0 ? `${stringify(config)}
@@ -354,34 +438,101 @@ email = \${NPM_EMAIL}`);
   }
 };
 
-const verifyAuth = async (npmrc, package_, context) => {
-  const {
-    cwd,
-    env: { DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org/", ...environment },
-    logger,
-    stderr,
-    stdout
-  } = context;
-  const registry = getRegistry(package_, context);
-  await setNpmrcAuth(npmrc, registry, context);
-  if (normalizeUrl(registry) === normalizeUrl(DEFAULT_NPM_REGISTRY)) {
-    try {
-      logger.log(`Running "pnpm whoami" to verify authentication on registry "${registry}"`);
-      const whoamiResult = execa("pnpm", ["whoami", "--userconfig", npmrc, "--registry", registry], {
-        cwd,
-        env: environment,
-        preferLocal: true
-      });
-      whoamiResult.stdout.pipe(stdout, { end: false });
-      whoamiResult.stderr.pipe(stderr, { end: false });
-      await whoamiResult;
-    } catch {
-      const semanticError = getError("EINVALIDNPMTOKEN", { registry });
-      throw new AggregateError([semanticError], semanticError.message);
+const isConnectionError = (error) => {
+  const errorMessage = error instanceof Error ? error.message : String(error);
+  const errorCode = error?.code || "";
+  const isTimedOut = error?.timedOut === true;
+  return isTimedOut || errorCode === "ECONNREFUSED" || errorCode === "ETIMEDOUT" || errorMessage.includes("ECONNREFUSED") || errorMessage.includes("ETIMEDOUT") || errorMessage.includes("getaddrinfo ENOTFOUND") || errorMessage.includes("timed out");
+};
+const verifyAuthContextAgainstRegistry = async (npmrc, registry, context) => {
+  const { cwd, env, logger, stderr, stdout } = context;
+  try {
+    logger.log(`Running "pnpm whoami" to verify authentication on registry "${registry}"`);
+    const whoamiResult = await execa("pnpm", ["whoami", "--registry", registry], {
+      cwd,
+      env: {
+        ...env,
+        NPM_CONFIG_USERCONFIG: npmrc
+      },
+      preferLocal: true,
+      timeout: 5e3
+      // 5 second timeout to prevent hanging when registry is unavailable
+    });
+    if (whoamiResult.stdout) {
+      stdout.write(whoamiResult.stdout);
     }
-  } else {
-    logger.log(`Skipping authentication verification for non-default registry "${registry}"`);
+    if (whoamiResult.stderr) {
+      stderr.write(whoamiResult.stderr);
+    }
+  } catch (error) {
+    if (isConnectionError(error)) {
+      const semanticError2 = getError("EINVALIDNPMAUTH", { registry });
+      throw new AggregateError([semanticError2], semanticError2.message);
+    }
+    const semanticError = getError("EINVALIDNPMTOKEN", { registry });
+    throw new AggregateError([semanticError], semanticError.message);
+  }
+};
+const isAuthErrorMessage = (message) => message.includes("requires you to be logged in") || message.includes("authentication") || message.includes("Unauthorized") || message.includes("401") || message.includes("403");
+const handlePublishError = (error, registry) => {
+  if (error instanceof AggregateError) {
+    throw error;
+  }
+  const errorStderrRaw = error?.stderr;
+  const errorStderr = Array.isArray(errorStderrRaw) ? errorStderrRaw.join("\n") : errorStderrRaw || "";
+  const errorMessage = error instanceof Error ? error.message : String(error);
+  const combinedMessage = `${errorStderr} ${errorMessage}`;
+  if (isConnectionError(error)) {
+    const semanticError = getError("EINVALIDNPMAUTH", { registry });
+    throw new AggregateError([semanticError], semanticError.message);
+  }
+  if (isAuthErrorMessage(combinedMessage)) {
+    const semanticError = getError("EINVALIDNPMAUTH", { registry });
+    throw new AggregateError([semanticError], semanticError.message);
   }
+  throw error;
+};
+const verifyAuthContextAgainstCustomRegistry = async (npmrc, registry, context, pkgRoot = ".") => {
+  const { cwd, env, logger, stderr, stdout } = context;
+  try {
+    logger.log(`Running "pnpm publish --dry-run" to verify authentication on registry "${registry}"`);
+    const publishArgs = ["publish", pkgRoot, "--dry-run", "--tag=semantic-release-auth-check", "--registry", registry];
+    const publishOptions = {
+      cwd,
+      env: {
+        ...env,
+        NPM_CONFIG_USERCONFIG: npmrc
+      },
+      preferLocal: true,
+      timeout: 5e3
+      // 5 second timeout to prevent hanging when registry is unavailable
+    };
+    const publishResult = await execa("pnpm", publishArgs, publishOptions);
+    const stdoutString = Array.isArray(publishResult.stdout) ? publishResult.stdout.join("\n") : publishResult.stdout || "";
+    const stderrString = Array.isArray(publishResult.stderr) ? publishResult.stderr.join("\n") : publishResult.stderr || "";
+    if (stdoutString) {
+      stdout.write(stdoutString);
+    }
+    if (stderrString) {
+      stderr.write(stderrString);
+      if (isAuthErrorMessage(stderrString)) {
+        const semanticError = getError("EINVALIDNPMAUTH", { registry });
+        throw new AggregateError([semanticError], semanticError.message);
+      }
+    }
+  } catch (error) {
+    handlePublishError(error, registry);
+  }
+};
+const verifyAuth = async (npmrc, package_, context, pkgRoot) => {
+  const registry = getRegistry(package_, context);
+  if (package_.name && await oidcContext(registry, package_, context)) {
+    return;
+  }
+  await setNpmrcAuth(npmrc, registry, context);
+  const normalizedRegistry = normalizeUrl(registry);
+  const normalizedOfficialRegistry = normalizeUrl(OFFICIAL_REGISTRY);
+  await (normalizedRegistry === normalizedOfficialRegistry ? verifyAuthContextAgainstRegistry(npmrc, registry, context) : verifyAuthContextAgainstCustomRegistry(npmrc, registry, context, pkgRoot));
 };
 
 const isString = (value) => typeof value === "string";
@@ -440,7 +591,7 @@ const verify = async (pluginConfig, context) => {
     const packageJson = await getPackage(pluginConfig, context);
     if (shouldPublish(pluginConfig, packageJson)) {
       const npmrc = getNpmrcPath(context.cwd, context.env);
-      await verifyAuth(npmrc, packageJson, context);
+      await verifyAuth(npmrc, packageJson, context, pluginConfig.pkgRoot);
     }
   } catch (error) {
     const typedError = error;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anolilab/semantic-release-pnpm",
-  "version": "3.0.0-alpha.1",
+  "version": "3.0.0-alpha.3",
   "description": "Semantic-release plugin to publish a npm package with pnpm.",
   "keywords": [
     "anolilab",
@@ -46,13 +46,15 @@
     "dist"
   ],
   "dependencies": {
-    "@anolilab/rc": "3.0.0-alpha.1",
+    "@actions/core": "^1.11.1",
+    "@anolilab/rc": "3.0.0-alpha.3",
     "@semantic-release/error": "^4.0.0",
-    "@visulima/fs": "^3.1.9",
-    "@visulima/package": "^4.0.2",
-    "@visulima/path": "^1.4.0",
+    "@visulima/fs": "^4.0.4",
+    "@visulima/package": "^4.1.4",
+    "@visulima/path": "^2.0.3",
+    "env-ci": "^11.2.0",
     "execa": "^9.6.0",
-    "ini": "^5.0.0",
+    "ini": "^6.0.0",
     "normalize-url": "^8.1.0",
     "registry-auth-token": "^5.1.0",
     "semver": "^7.7.3"