@anolilab/semantic-release-pnpm 3.0.0-alpha.2 → 3.0.0

package/CHANGELOG.md

@@ -1,3 +1,71 @@
+## @anolilab/semantic-release-pnpm [3.0.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@2.0.5...@anolilab/semantic-release-pnpm@3.0.0) (2025-11-20)
+
+### ⚠ BREAKING CHANGES
+
+* - node-versions: the minimum node version for the v24 range is now v24.10.0
+- deps: a minimum of node v22.14 is now required
+
+### Features
+
+* enhance npm authentication and trusted publishing support ([440d032](https://github.com/anolilab/semantic-release/commit/440d032f90c281da4640f07b991a963ba8cf5f5e))
+* update dependencies in pnpm-lock.yaml and pnpm-workspace.yaml ([7e73992](https://github.com/anolilab/semantic-release/commit/7e739923afdd7deea2621d97feac2713ca63eccc))
+
+### Bug Fixes
+
+* enhance integration and unit tests for npm authentication ([79ae50d](https://github.com/anolilab/semantic-release/commit/79ae50d47362159a426d31acc9432ba3ac31993e))
+* update dependencies and configurations across multiple packages ([c37a51f](https://github.com/anolilab/semantic-release/commit/c37a51f53899c7088140d398867ed9ab7b291acf))
+* update dependencies and node version across multiple packages ([cbfde4b](https://github.com/anolilab/semantic-release/commit/cbfde4b18e22a3994c70f145e9a9a6c71f4539c8))
+* update package dependencies and configurations ([fed735c](https://github.com/anolilab/semantic-release/commit/fed735c729647a595d587eaa162d2c44ff9948f1))
+
+### Miscellaneous Chores
+
+* add '@types/env-ci' dependency and refine type handling ([f897d6c](https://github.com/anolilab/semantic-release/commit/f897d6c26436790504bcb8ca98095e4ab3f2bd61))
+* **release:** @anolilab/semantic-release-pnpm@3.0.0-alpha.1 [skip ci]\n\n## @anolilab/semantic-release-pnpm [3.0.0-alpha.1](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@2.0.4...@anolilab/semantic-release-pnpm@3.0.0-alpha.1) (2025-10-14) ([9bb7063](https://github.com/anolilab/semantic-release/commit/9bb70635b0ae006601904268ae544fe26c710c72))
+* **release:** @anolilab/semantic-release-pnpm@3.0.0-alpha.2 [skip ci]\n\n## @anolilab/semantic-release-pnpm [3.0.0-alpha.2](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.0.0-alpha.1...@anolilab/semantic-release-pnpm@3.0.0-alpha.2) (2025-10-21) ([37b9d43](https://github.com/anolilab/semantic-release/commit/37b9d4395188554e200928de4347e8a092dc994d))
+* **release:** @anolilab/semantic-release-pnpm@3.0.0-alpha.3 [skip ci]\n\n## @anolilab/semantic-release-pnpm [3.0.0-alpha.3](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.0.0-alpha.2...@anolilab/semantic-release-pnpm@3.0.0-alpha.3) (2025-11-20) ([e475a24](https://github.com/anolilab/semantic-release/commit/e475a24dc1899e9dd55d3e05c0d25ddca045bdb2))
+* update '@actions/core' dependency in semantic-release-pnpm ([50cc6e0](https://github.com/anolilab/semantic-release/commit/50cc6e09e2d1959acdcfc6475c1ecfbcb0fdb406))
+* update '@actions/core' dependency to production in pnpm configuration ([bfec287](https://github.com/anolilab/semantic-release/commit/bfec287c74f048f41bcb0517353d3d4dede451a0))
+* update Node.js version and refine dependencies in pnpm-workspace ([cbd6172](https://github.com/anolilab/semantic-release/commit/cbd617234ac6e5f5a14b70fbf6d6aec3bcd38fe0))
+
+### Code Refactoring
+
+* clean up whitespace and comments in get-config.ts and verify-auth.ts ([26dc037](https://github.com/anolilab/semantic-release/commit/26dc037917f281f24d096d9790b671262f432b24))
+* enhance inline plugin creator with consistent git root handling ([4ebaea4](https://github.com/anolilab/semantic-release/commit/4ebaea46d35bb89a0adcb4bf58c6df559e35f107))
+* enhance type handling and logging in multi-semantic-release ([b6b34c2](https://github.com/anolilab/semantic-release/commit/b6b34c22fd835478f7009e3204a61abb953a9fb4))
+* Ensure consistent cwd handling across all plugin hooks ([3028b71](https://github.com/anolilab/semantic-release/commit/3028b71f6f16244968bd6646b042ac893ffa5bb9))
+* update test cases and improve type handling ([328c392](https://github.com/anolilab/semantic-release/commit/328c39278c609fd9169df79f3f48bbd8038d2e64))
+
+
+### Dependencies
+
+* **@anolilab/rc:** upgraded to 3.0.0
+
+## @anolilab/semantic-release-pnpm [3.0.0-alpha.3](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.0.0-alpha.2...@anolilab/semantic-release-pnpm@3.0.0-alpha.3) (2025-11-20)
+
+### Bug Fixes
+
+* enhance integration and unit tests for npm authentication ([79ae50d](https://github.com/anolilab/semantic-release/commit/79ae50d47362159a426d31acc9432ba3ac31993e))
+* update package dependencies and configurations ([fed735c](https://github.com/anolilab/semantic-release/commit/fed735c729647a595d587eaa162d2c44ff9948f1))
+
+### Miscellaneous Chores
+
+* add '@types/env-ci' dependency and refine type handling ([f897d6c](https://github.com/anolilab/semantic-release/commit/f897d6c26436790504bcb8ca98095e4ab3f2bd61))
+* update '@actions/core' dependency in semantic-release-pnpm ([50cc6e0](https://github.com/anolilab/semantic-release/commit/50cc6e09e2d1959acdcfc6475c1ecfbcb0fdb406))
+* update '@actions/core' dependency to production in pnpm configuration ([bfec287](https://github.com/anolilab/semantic-release/commit/bfec287c74f048f41bcb0517353d3d4dede451a0))
+* update Node.js version and refine dependencies in pnpm-workspace ([cbd6172](https://github.com/anolilab/semantic-release/commit/cbd617234ac6e5f5a14b70fbf6d6aec3bcd38fe0))
+
+### Code Refactoring
+
+* clean up whitespace and comments in get-config.ts and verify-auth.ts ([26dc037](https://github.com/anolilab/semantic-release/commit/26dc037917f281f24d096d9790b671262f432b24))
+* enhance inline plugin creator with consistent git root handling ([4ebaea4](https://github.com/anolilab/semantic-release/commit/4ebaea46d35bb89a0adcb4bf58c6df559e35f107))
+* Ensure consistent cwd handling across all plugin hooks ([3028b71](https://github.com/anolilab/semantic-release/commit/3028b71f6f16244968bd6646b042ac893ffa5bb9))
+* update test cases and improve type handling ([328c392](https://github.com/anolilab/semantic-release/commit/328c39278c609fd9169df79f3f48bbd8038d2e64))
+
+
+### Dependencies
+
+* **@anolilab/rc:** upgraded to 3.0.0-alpha.3
+
 ## @anolilab/semantic-release-pnpm [3.0.0-alpha.2](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.0.0-alpha.1...@anolilab/semantic-release-pnpm@3.0.0-alpha.2) (2025-10-21)
 
 ### Features
@@ -31,6 +99,17 @@
 
 * **@anolilab/rc:** upgraded to 3.0.0-alpha.1
 
+## @anolilab/semantic-release-pnpm [2.0.5](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@2.0.4...@anolilab/semantic-release-pnpm@2.0.5) (2025-11-01)
+
+### Bug Fixes
+
+* update package dependencies and configurations ([d94ebd8](https://github.com/anolilab/semantic-release/commit/d94ebd8869c34106aa0c11beb0f7410bbc86367f))
+
+
+### Dependencies
+
+* **@anolilab/rc:** upgraded to 2.0.5
+
 ## @anolilab/semantic-release-pnpm [2.0.4](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@2.0.3...@anolilab/semantic-release-pnpm@2.0.4) (2025-09-22)
 
 ### Bug Fixes

package/dist/index.js

@@ -1,37 +1,34 @@
 import { createRequire as __cjs_createRequire } from "node:module";
+
 const __cjs_require = __cjs_createRequire(import.meta.url);
 
-// Runtime capability helpers
+const __cjs_getProcess = typeof globalThis !== "undefined" && typeof globalThis.process !== "undefined" ? globalThis.process : process;
+
 const __cjs_getBuiltinModule = (module) => {
     // Check if we're in Node.js and version supports getBuiltinModule
-    if ("object" !== "undefined" && process.versions?.node) {
-        const [major, minor] = process.versions.node.split(".").map(Number);
+    if (typeof __cjs_getProcess !== "undefined" && __cjs_getProcess.versions && __cjs_getProcess.versions.node) {
+        const [major, minor] = __cjs_getProcess.versions.node.split(".").map(Number);
         // Node.js 20.16.0+ and 22.3.0+
         if (major > 22 || (major === 22 && minor >= 3) || (major === 20 && minor >= 16)) {
-            return process.getBuiltinModule(module);
+            return __cjs_getProcess.getBuiltinModule(module);
         }
     }
     // Fallback to createRequire
     return __cjs_require(module);
 };
 
-const __cjs_getProcess = typeof globalThis !== "undefined" && typeof globalThis.process !== "undefined" ? globalThis.process : process;
 import { execa } from 'execa';
-const {
-  validRange,
-  gte
-} = __cjs_require("semver");
+import { validRange, gte } from 'semver';
 import { isAccessibleSync, ensureFileSync, move, writeFile } from '@visulima/fs';
 import { resolve } from '@visulima/path';
 import { rc } from '@anolilab/rc';
 import normalizeUrl from 'normalize-url';
 import { findPackageJson, getPackageManagerVersion } from '@visulima/package';
 import SemanticReleaseError from '@semantic-release/error';
+import { getIDToken } from '@actions/core';
 import envCi from 'env-ci';
-const {
-  stringify
-} = __cjs_require("ini");
-const getAuthToken = __cjs_require("registry-auth-token");
+import { stringify } from 'ini';
+import getAuthToken from 'registry-auth-token';
 const {
   URL
 } = __cjs_getBuiltinModule("node:url");
@@ -114,9 +111,12 @@ const addChannel$1 = async (pluginConfig, packageJson, context) => {
     const distributionTag = getChannel(channel);
     logger.log(`Adding version ${version} to npm registry on dist-tag ${distributionTag}`);
     const npmrc = getNpmrcPath(cwd, env);
-    const result = execa("pnpm", ["dist-tag", "add", `${packageJson.name}@${version}`, distributionTag, "--userconfig", npmrc, "--registry", registry], {
+    const result = execa("pnpm", ["dist-tag", "add", `${packageJson.name}@${version}`, distributionTag, "--registry", registry], {
       cwd,
-      env,
+      env: {
+        ...env,
+        NPM_CONFIG_USERCONFIG: npmrc
+      },
       preferLocal: true
     });
     result.stdout.pipe(stdout, { end: false });
@@ -201,7 +201,7 @@ const publish$1 = async (pluginConfig, packageJson, context) => {
   return false;
 };
 
-const homepage = "https://github.com/anolilab/semantic-release/tree/main/packages/semantic-release-pnpm";
+var homepage = "https://github.com/anolilab/semantic-release/tree/main/packages/semantic-release-pnpm";
 const packageJson = {
 	homepage: homepage};
 
@@ -346,7 +346,6 @@ const exchangeGithubActionsToken = async (packageName, logger) => {
   let idToken;
   logger.log("Verifying OIDC context for publishing from GitHub Actions");
   try {
-    const { getIDToken } = await import('@actions/core');
     idToken = await getIDToken("npm:registry.npmjs.org");
   } catch (error) {
     logger.log(`Retrieval of GitHub Actions OIDC token failed: ${error.message}`);
@@ -354,6 +353,8 @@ const exchangeGithubActionsToken = async (packageName, logger) => {
     return void 0;
   }
   if (!idToken) {
+    logger.log("NPM_ID_TOKEN environment variable is not set");
+    logger.log("Configure trusted publishing in your GitLab project settings and set the NPM_ID_TOKEN variable");
     return void 0;
   }
   return exchangeIdToken(idToken, packageName, logger);
@@ -367,7 +368,16 @@ const exchangeGitlabPipelinesToken = async (packageName, logger) => {
   return exchangeIdToken(idToken, packageName, logger);
 };
 const tokenExchange = (pkg, { logger }) => {
-  const { name: ciProviderName } = envCi();
+  if (!pkg.name || typeof pkg.name !== "string" || pkg.name.trim() === "") {
+    logger.log("Invalid package name provided for OIDC token exchange");
+    return Promise.resolve(void 0);
+  }
+  const ciEnv = envCi();
+  const ciProviderName = typeof ciEnv === "object" && ciEnv !== null && typeof ciEnv.name === "string" ? ciEnv.name : void 0;
+  if (!ciProviderName) {
+    logger.log("Unable to detect CI provider for OIDC token exchange");
+    return Promise.resolve(void 0);
+  }
   if (GITHUB_ACTIONS_PROVIDER_NAME === ciProviderName) {
     return exchangeGithubActionsToken(pkg.name, logger);
   }
@@ -411,9 +421,12 @@ const setNpmrcAuth = async (npmrc, registry, { cwd, env: { NPM_CONFIG_USERCONFIG
     return;
   }
   if (NPM_USERNAME && NPM_PASSWORD && NPM_EMAIL) {
-    await writeFile(npmrc, `${Object.keys(config).length > 0 ? `${stringify(config)}
-` : ""}_auth = \${LEGACY_TOKEN}
-email = \${NPM_EMAIL}`);
+    await writeFile(
+      npmrc,
+      `${Object.keys(config).length > 0 ? `${stringify(config)}
+` : ""}${nerfDart(registry)}:_auth = \${LEGACY_TOKEN}
+email = \${NPM_EMAIL}`
+    );
     logger.log(`Wrote NPM_USERNAME, NPM_PASSWORD, and NPM_EMAIL to ${npmrc}`);
   } else if (NPM_TOKEN) {
     await writeFile(npmrc, `${Object.keys(config).length > 0 ? `${stringify(config)}
@@ -425,20 +438,25 @@ email = \${NPM_EMAIL}`);
   }
 };
 
+const isConnectionError = (error) => {
+  const errorMessage = error instanceof Error ? error.message : String(error);
+  const errorCode = error?.code || "";
+  const isTimedOut = error?.timedOut === true;
+  return isTimedOut || errorCode === "ECONNREFUSED" || errorCode === "ETIMEDOUT" || errorMessage.includes("ECONNREFUSED") || errorMessage.includes("ETIMEDOUT") || errorMessage.includes("getaddrinfo ENOTFOUND") || errorMessage.includes("timed out");
+};
 const verifyAuthContextAgainstRegistry = async (npmrc, registry, context) => {
-  const {
-    cwd,
-    env: { ...environment },
-    logger,
-    stderr,
-    stdout
-  } = context;
+  const { cwd, env, logger, stderr, stdout } = context;
   try {
     logger.log(`Running "pnpm whoami" to verify authentication on registry "${registry}"`);
-    const whoamiResult = await execa("pnpm", ["whoami", "--userconfig", npmrc, "--registry", registry], {
+    const whoamiResult = await execa("pnpm", ["whoami", "--registry", registry], {
       cwd,
-      env: environment,
-      preferLocal: true
+      env: {
+        ...env,
+        NPM_CONFIG_USERCONFIG: npmrc
+      },
+      preferLocal: true,
+      timeout: 5e3
+      // 5 second timeout to prevent hanging when registry is unavailable
     });
     if (whoamiResult.stdout) {
       stdout.write(whoamiResult.stdout);
@@ -446,23 +464,75 @@ const verifyAuthContextAgainstRegistry = async (npmrc, registry, context) => {
     if (whoamiResult.stderr) {
       stderr.write(whoamiResult.stderr);
     }
-  } catch {
+  } catch (error) {
+    if (isConnectionError(error)) {
+      const semanticError2 = getError("EINVALIDNPMAUTH", { registry });
+      throw new AggregateError([semanticError2], semanticError2.message);
+    }
     const semanticError = getError("EINVALIDNPMTOKEN", { registry });
     throw new AggregateError([semanticError], semanticError.message);
   }
 };
+const isAuthErrorMessage = (message) => message.includes("requires you to be logged in") || message.includes("authentication") || message.includes("Unauthorized") || message.includes("401") || message.includes("403");
+const handlePublishError = (error, registry) => {
+  if (error instanceof AggregateError) {
+    throw error;
+  }
+  const errorStderrRaw = error?.stderr;
+  const errorStderr = Array.isArray(errorStderrRaw) ? errorStderrRaw.join("\n") : errorStderrRaw || "";
+  const errorMessage = error instanceof Error ? error.message : String(error);
+  const combinedMessage = `${errorStderr} ${errorMessage}`;
+  if (isConnectionError(error)) {
+    const semanticError = getError("EINVALIDNPMAUTH", { registry });
+    throw new AggregateError([semanticError], semanticError.message);
+  }
+  if (isAuthErrorMessage(combinedMessage)) {
+    const semanticError = getError("EINVALIDNPMAUTH", { registry });
+    throw new AggregateError([semanticError], semanticError.message);
+  }
+  throw error;
+};
+const verifyAuthContextAgainstCustomRegistry = async (npmrc, registry, context, pkgRoot = ".") => {
+  const { cwd, env, logger, stderr, stdout } = context;
+  try {
+    logger.log(`Running "pnpm publish --dry-run" to verify authentication on registry "${registry}"`);
+    const publishArgs = ["publish", pkgRoot, "--dry-run", "--tag=semantic-release-auth-check", "--registry", registry];
+    const publishOptions = {
+      cwd,
+      env: {
+        ...env,
+        NPM_CONFIG_USERCONFIG: npmrc
+      },
+      preferLocal: true,
+      timeout: 5e3
+      // 5 second timeout to prevent hanging when registry is unavailable
+    };
+    const publishResult = await execa("pnpm", publishArgs, publishOptions);
+    const stdoutString = Array.isArray(publishResult.stdout) ? publishResult.stdout.join("\n") : publishResult.stdout || "";
+    const stderrString = Array.isArray(publishResult.stderr) ? publishResult.stderr.join("\n") : publishResult.stderr || "";
+    if (stdoutString) {
+      stdout.write(stdoutString);
+    }
+    if (stderrString) {
+      stderr.write(stderrString);
+      if (isAuthErrorMessage(stderrString)) {
+        const semanticError = getError("EINVALIDNPMAUTH", { registry });
+        throw new AggregateError([semanticError], semanticError.message);
+      }
+    }
+  } catch (error) {
+    handlePublishError(error, registry);
+  }
+};
 const verifyAuth = async (npmrc, package_, context, pkgRoot) => {
   const registry = getRegistry(package_, context);
   if (package_.name && await oidcContext(registry, package_, context)) {
     return;
   }
   await setNpmrcAuth(npmrc, registry, context);
-  const {
-    env: { DEFAULT_NPM_REGISTRY = OFFICIAL_REGISTRY }
-  } = context;
-  if (normalizeUrl(registry) === normalizeUrl(DEFAULT_NPM_REGISTRY)) {
-    await verifyAuthContextAgainstRegistry(npmrc, registry, context);
-  }
+  const normalizedRegistry = normalizeUrl(registry);
+  const normalizedOfficialRegistry = normalizeUrl(OFFICIAL_REGISTRY);
+  await (normalizedRegistry === normalizedOfficialRegistry ? verifyAuthContextAgainstRegistry(npmrc, registry, context) : verifyAuthContextAgainstCustomRegistry(npmrc, registry, context, pkgRoot));
 };
 
 const isString = (value) => typeof value === "string";
@@ -521,7 +591,7 @@ const verify = async (pluginConfig, context) => {
     const packageJson = await getPackage(pluginConfig, context);
     if (shouldPublish(pluginConfig, packageJson)) {
       const npmrc = getNpmrcPath(context.cwd, context.env);
-      await verifyAuth(npmrc, packageJson, context);
+      await verifyAuth(npmrc, packageJson, context, pluginConfig.pkgRoot);
     }
   } catch (error) {
     const typedError = error;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anolilab/semantic-release-pnpm",
-  "version": "3.0.0-alpha.2",
+  "version": "3.0.0",
   "description": "Semantic-release plugin to publish a npm package with pnpm.",
   "keywords": [
     "anolilab",
@@ -47,14 +47,14 @@
   ],
   "dependencies": {
     "@actions/core": "^1.11.1",
-    "@anolilab/rc": "3.0.0-alpha.2",
+    "@anolilab/rc": "3.0.0",
     "@semantic-release/error": "^4.0.0",
-    "@visulima/fs": "^4.0.2",
-    "@visulima/package": "^4.1.2",
-    "@visulima/path": "^2.0.1",
+    "@visulima/fs": "^4.0.4",
+    "@visulima/package": "^4.1.4",
+    "@visulima/path": "^2.0.3",
     "env-ci": "^11.2.0",
     "execa": "^9.6.0",
-    "ini": "^5.0.0",
+    "ini": "^6.0.0",
     "normalize-url": "^8.1.0",
     "registry-auth-token": "^5.1.0",
     "semver": "^7.7.3"