@anolilab/semantic-release-pnpm 3.1.0 → 3.2.0

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+## @anolilab/semantic-release-pnpm [3.2.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.1.0...@anolilab/semantic-release-pnpm@3.2.0) (2025-12-04)
+
+### Bug Fixes
+
+* enhanced OIDC context handling, added better debug logs ([#239](https://github.com/anolilab/semantic-release/issues/239)) ([2ae7ea5](https://github.com/anolilab/semantic-release/commit/2ae7ea5282d20254b96bbf768c2b1af2e868b6ae))
+
+### Miscellaneous Chores
+
+* enhance package.json keywords across multiple packages ([842cd32](https://github.com/anolilab/semantic-release/commit/842cd32acf48c34d3226b1b2d63e7cdecdeff6b7))
+
+
+### Dependencies
+
+* **@anolilab/rc:** upgraded to 3.2.0
+
 ## @anolilab/semantic-release-pnpm [3.1.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.0.0...@anolilab/semantic-release-pnpm@3.1.0) (2025-11-25)
 
 

package/README.md

@@ -74,6 +74,13 @@ When publishing to the [official registry](https://registry.npmjs.org/), it is r
 > [!NOTE]
 > When using trusted publishing, provenance attestations are automatically generated for your packages without requiring provenance to be explicitly enabled.
 
+> [!IMPORTANT]
+> **First-time releases with OIDC**: npm requires a package to exist before you can configure OIDC trusted publishing. If you're releasing a package for the first time with OIDC, you have two options:
+> 1. Publish a dummy version manually first (e.g., `pnpm publish --tag dummy`), then configure OIDC trusted publishing, and then use semantic-release for subsequent releases.
+> 2. Use the [`setup-npm-trusted-publish`](https://github.com/azu/setup-npm-trusted-publish) tool to automatically create and publish a placeholder package for OIDC setup purposes.
+>
+> After the initial package exists, you can configure OIDC trusted publishing at `https://www.npmjs.com/package/<package-name>/access` and then use semantic-release for all future releases.
+
 ##### Trusted publishing from GitHub Actions
 
 To leverage trusted publishing and publish with provenance from GitHub Actions, the `id-token: write` permission is required to be enabled on the job:

package/dist/index.js

@@ -17,6 +17,7 @@ const __cjs_getBuiltinModule = (module) => {
     return __cjs_require(module);
 };
 
+import dbg from 'debug';
 import { execa } from 'execa';
 import { validRange, gte } from 'semver';
 import { isAccessibleSync, ensureFileSync, move, writeFile } from '@visulima/fs';
@@ -59,6 +60,7 @@ const OFFICIAL_REGISTRY = "https://registry.npmjs.org/";
 const GITHUB_ACTIONS_PROVIDER_NAME = "GitHub Actions";
 const GITLAB_PIPELINES_PROVIDER_NAME = "GitLab CI/CD";
 
+const debug$9 = dbg("semantic-release-pnpm:registry");
 const getRegistryUrl = (scope, npmrc) => {
   let url = OFFICIAL_REGISTRY;
   if (npmrc) {
@@ -69,14 +71,35 @@ const getRegistryUrl = (scope, npmrc) => {
   }
   return url.endsWith("/") ? url : `${url}/`;
 };
-const getRegistry = ({ name, publishConfig: { registry } = {} }, { cwd, env }) => registry ?? env.NPM_CONFIG_REGISTRY ?? getRegistryUrl(
-  name.split("/")[0],
-  rc("npm", {
-    config: env.NPM_CONFIG_USERCONFIG ?? resolve(cwd, ".npmrc"),
-    cwd,
-    defaults: { registry: OFFICIAL_REGISTRY }
-  }).config
-);
+const getRegistry = ({ name, publishConfig = {} }, { cwd, env }) => {
+  let resolvedRegistry;
+  let source;
+  const scope = name.split("/")[0];
+  const publishRegistry = publishConfig[`${scope}:registry`] ?? publishConfig.registry;
+  if (publishRegistry) {
+    resolvedRegistry = publishRegistry;
+    source = "package.json#publishConfig.registry";
+  } else if (env.NPM_CONFIG_REGISTRY) {
+    resolvedRegistry = env.NPM_CONFIG_REGISTRY;
+    source = "NPM_CONFIG_REGISTRY environment variable";
+  } else {
+    const npmrcConfig = rc("npm", {
+      config: env.NPM_CONFIG_USERCONFIG ?? resolve(cwd, ".npmrc"),
+      cwd,
+      defaults: { registry: OFFICIAL_REGISTRY }
+    });
+    const npmrc = npmrcConfig.config;
+    resolvedRegistry = getRegistryUrl(scope, npmrc);
+    if (npmrc && (npmrc[`${scope}:registry`] ?? npmrc.registry)) {
+      source = `.npmrc file (${npmrc[`${scope}:registry`] ? `scoped registry for ${scope}` : "default registry"})`;
+    } else {
+      source = "default registry (OFFICIAL_REGISTRY)";
+    }
+  }
+  const finalRegistry = resolvedRegistry.endsWith("/") ? resolvedRegistry : `${resolvedRegistry}/`;
+  debug$9(`Resolved registry "${finalRegistry}" from ${source}`);
+  return finalRegistry;
+};
 
 const getReleaseInfo = ({ name }, { env: { DEFAULT_NPM_REGISTRY = OFFICIAL_REGISTRY }, nextRelease: { version } }, distributionTag, registry) => {
   return {
@@ -97,6 +120,7 @@ const reasonToNotPublish = (pluginConfig, package_) => {
 };
 const shouldPublish = (pluginConfig, package_) => reasonToNotPublish(pluginConfig, package_) === null;
 
+const debug$8 = dbg("semantic-release-pnpm:add-channel");
 const addChannel$1 = async (pluginConfig, packageJson, context) => {
   const {
     cwd,
@@ -111,7 +135,9 @@ const addChannel$1 = async (pluginConfig, packageJson, context) => {
     const distributionTag = getChannel(channel);
     logger.log(`Adding version ${version} to npm registry on dist-tag ${distributionTag}`);
     const npmrc = getNpmrcPath(cwd, env);
-    const result = execa("pnpm", ["dist-tag", "add", `${packageJson.name}@${version}`, distributionTag, "--registry", registry], {
+    const distTagArguments = ["dist-tag", "add", `${packageJson.name}@${version}`, distributionTag, "--registry", registry];
+    debug$8(`Executing: pnpm ${distTagArguments.join(" ")}`);
+    const result = execa("pnpm", distTagArguments, {
       cwd,
       env: {
         ...env,
@@ -129,6 +155,7 @@ const addChannel$1 = async (pluginConfig, packageJson, context) => {
   return false;
 };
 
+const debug$7 = dbg("semantic-release-pnpm:prepare");
 const prepare$1 = async ({ pkgRoot, tarballDir }, { cwd, env, logger, nextRelease: { version }, stderr, stdout }) => {
   const basePath = pkgRoot ? resolve(cwd, pkgRoot) : cwd;
   logger.log("Write version %s to package.json in %s", version, basePath);
@@ -148,12 +175,17 @@ const prepare$1 = async ({ pkgRoot, tarballDir }, { cwd, env, logger, nextReleas
     const tarball = (await packResult).stdout.split("\n").pop();
     const tarballSource = resolve(cwd, tarball);
     const tarballDestination = resolve(cwd, tarballDir.trim(), tarball);
-    if (tarballSource !== tarballDestination) {
+    debug$7(`Created tarball: ${tarball}`);
+    if (tarballSource === tarballDestination) {
+      debug$7(`Tarball already at destination: ${tarballDestination}`);
+    } else {
+      debug$7(`Moving tarball from ${tarballSource} to ${tarballDestination}`);
       await move(tarballSource, tarballDestination);
     }
   }
 };
 
+const debug$6 = dbg("semantic-release-pnpm:publish");
 const publish$1 = async (pluginConfig, packageJson, context) => {
   const {
     cwd,
@@ -181,6 +213,7 @@ const publish$1 = async (pluginConfig, packageJson, context) => {
     if (pluginConfig.disableScripts) {
       pnpmArguments.push("--ignore-scripts");
     }
+    debug$6(`Executing: pnpm ${pnpmArguments.join(" ")}`);
     const result = execa("pnpm", pnpmArguments, {
       cwd,
       env,
@@ -329,72 +362,96 @@ const getPackage = async ({ pkgRoot }, { cwd }) => {
   }
 };
 
-const exchangeIdToken = async (idToken, packageName, logger) => {
+const debug$5 = dbg("semantic-release-pnpm:token-exchange");
+const exchangeIdToken = async (idToken, packageName, context) => {
   const response = await fetch(`${OFFICIAL_REGISTRY}-/npm/v1/oidc/token/exchange/package/${encodeURIComponent(packageName)}`, {
     headers: { Authorization: `Bearer ${idToken}` },
     method: "POST"
   });
   const responseBody = await response.json();
   if (response.ok) {
-    logger.log("OIDC token exchange with the npm registry succeeded");
+    debug$5("OIDC token exchange with the npm registry succeeded");
     return responseBody.token;
   }
-  logger.log(`OIDC token exchange with the npm registry failed: ${response.status} ${responseBody.message}`);
+  debug$5(`OIDC token exchange with the npm registry failed: ${response.status} ${responseBody.message}`);
+  if (response.status === 404 || responseBody.message?.toLowerCase().includes("not found")) {
+    const warningMessage = `Package "${packageName}" does not exist on npm. npm requires a package to exist before you can configure OIDC trusted publishing. You can either publish a dummy version manually first (e.g., \`pnpm publish --tag dummy\`) or use the \`setup-npm-trusted-publish\` tool (https://github.com/azu/setup-npm-trusted-publish) to create a placeholder package. After the package exists, configure OIDC trusted publishing at https://www.npmjs.com/package/${encodeURIComponent(packageName)}/access`;
+    context?.logger?.error(warningMessage);
+    debug$5(warningMessage);
+  }
   return void 0;
 };
-const exchangeGithubActionsToken = async (packageName, logger) => {
+const exchangeGithubActionsToken = async (packageName, context) => {
   let idToken;
-  logger.log("Verifying OIDC context for publishing from GitHub Actions");
+  debug$5("Verifying OIDC context for publishing from GitHub Actions");
   try {
     idToken = await getIDToken("npm:registry.npmjs.org");
   } catch (error) {
-    logger.log(`Retrieval of GitHub Actions OIDC token failed: ${error.message}`);
-    logger.log("Have you granted the `id-token: write` permission to this workflow?");
+    debug$5(`Retrieval of GitHub Actions OIDC token failed: ${error.message}`);
+    debug$5("Have you granted the `id-token: write` permission to this workflow?");
     return void 0;
   }
   if (!idToken) {
-    logger.log("NPM_ID_TOKEN environment variable is not set");
-    logger.log("Configure trusted publishing in your GitLab project settings and set the NPM_ID_TOKEN variable");
+    debug$5("GitHub Actions OIDC token is not available");
+    debug$5("Have you granted the `id-token: write` permission to this workflow?");
     return void 0;
   }
-  return exchangeIdToken(idToken, packageName, logger);
+  return exchangeIdToken(idToken, packageName, context);
 };
-const exchangeGitlabPipelinesToken = async (packageName, logger) => {
+const exchangeGitlabPipelinesToken = async (packageName, context) => {
   const idToken = process.env.NPM_ID_TOKEN;
-  logger.log("Verifying OIDC context for publishing from GitLab Pipelines");
+  debug$5("Verifying OIDC context for publishing from GitLab Pipelines");
   if (!idToken) {
+    debug$5("NPM_ID_TOKEN environment variable is not set");
+    debug$5("Configure trusted publishing in your GitLab project settings and set the NPM_ID_TOKEN variable");
     return void 0;
   }
-  return exchangeIdToken(idToken, packageName, logger);
+  return exchangeIdToken(idToken, packageName, context);
 };
-const tokenExchange = (pkg, { logger }) => {
+const tokenExchange = (pkg, context) => {
   if (!pkg.name || typeof pkg.name !== "string" || pkg.name.trim() === "") {
-    logger.log("Invalid package name provided for OIDC token exchange");
+    context.logger.error("Invalid package name provided for OIDC token exchange");
     return Promise.resolve(void 0);
   }
   const ciEnv = envCi();
   const ciProviderName = typeof ciEnv === "object" && ciEnv !== null && typeof ciEnv.name === "string" ? ciEnv.name : void 0;
   if (!ciProviderName) {
-    logger.log("Unable to detect CI provider for OIDC token exchange");
+    debug$5("Unable to detect CI provider for OIDC token exchange");
+    debug$5("Supported CI providers for OIDC trusted publishing: GitHub Actions, GitLab CI/CD");
     return Promise.resolve(void 0);
   }
+  debug$5(`Detected CI provider: ${ciProviderName}`);
   if (GITHUB_ACTIONS_PROVIDER_NAME === ciProviderName) {
-    return exchangeGithubActionsToken(pkg.name, logger);
+    return exchangeGithubActionsToken(pkg.name, context);
   }
   if (GITLAB_PIPELINES_PROVIDER_NAME === ciProviderName) {
-    return exchangeGitlabPipelinesToken(pkg.name, logger);
+    return exchangeGitlabPipelinesToken(pkg.name, context);
   }
+  debug$5(`CI provider "${ciProviderName}" is not supported for OIDC trusted publishing`);
+  debug$5("Supported CI providers: GitHub Actions, GitLab CI/CD");
   return Promise.resolve(void 0);
 };
 
+const debug$4 = dbg("semantic-release-pnpm:oidc-context");
 const oidcContext = async (registry, pkg, context) => {
-  if (OFFICIAL_REGISTRY !== registry) {
+  const normalizedRegistry = normalizeUrl(registry);
+  const normalizedOfficialRegistry = normalizeUrl(OFFICIAL_REGISTRY);
+  if (normalizedRegistry !== normalizedOfficialRegistry) {
+    debug$4(
+      `Registry "${registry}" (normalized: "${normalizedRegistry}") does not match official registry "${OFFICIAL_REGISTRY}" (normalized: "${normalizedOfficialRegistry}"), skipping OIDC check`
+    );
     return false;
   }
+  debug$4(`Registry matches official npm registry, attempting OIDC token exchange for package "${pkg.name ?? "unknown"}"`);
   try {
     const token = await tokenExchange({ name: pkg.name ?? "" }, context);
+    if (!token) {
+      debug$4("OIDC token exchange did not succeed, falling back to NPM_TOKEN authentication");
+    }
     return !!token;
-  } catch {
+  } catch (error) {
+    debug$4(`OIDC context check failed: ${error instanceof Error ? error.message : String(error)}`);
+    debug$4("Falling back to NPM_TOKEN authentication");
     return false;
   }
 };
@@ -406,6 +463,7 @@ const nerfDart = (url) => {
   return `//${real.host}${real.pathname}`;
 };
 
+const debug$3 = dbg("semantic-release-pnpm:auth");
 const setNpmrcAuth = async (npmrc, registry, { cwd, env: { NPM_CONFIG_USERCONFIG, NPM_EMAIL, NPM_PASSWORD, NPM_TOKEN, NPM_USERNAME }, logger }) => {
   logger.log("Verify authentication for registry %s", registry);
   const { config, files } = rc("npm", {
@@ -416,11 +474,14 @@ const setNpmrcAuth = async (npmrc, registry, { cwd, env: { NPM_CONFIG_USERCONFIG
   if (Array.isArray(files)) {
     logger.log("Reading npm config from %s", files.join(", "));
   }
-  if (getAuthToken(registry, { npmrc: config })) {
+  const existingToken = getAuthToken(registry, { npmrc: config });
+  if (existingToken) {
+    debug$3(`Using existing authentication token from npmrc files for registry "${registry}"`);
     await writeFile(npmrc, stringify(config));
     return;
   }
   if (NPM_USERNAME && NPM_PASSWORD && NPM_EMAIL) {
+    debug$3(`Using username/password/email authentication strategy for registry "${registry}"`);
     await writeFile(
       npmrc,
       `${Object.keys(config).length > 0 ? `${stringify(config)}
@@ -429,15 +490,18 @@ email = \${NPM_EMAIL}`
     );
     logger.log(`Wrote NPM_USERNAME, NPM_PASSWORD, and NPM_EMAIL to ${npmrc}`);
   } else if (NPM_TOKEN) {
+    debug$3(`Using NPM_TOKEN authentication strategy for registry "${registry}"`);
     await writeFile(npmrc, `${Object.keys(config).length > 0 ? `${stringify(config)}
 ` : ""}${nerfDart(registry)}:_authToken = \${NPM_TOKEN}`);
     logger.log(`Wrote NPM_TOKEN to ${npmrc}`);
   } else {
+    debug$3(`No authentication credentials found for registry "${registry}"`);
     const semanticError = getError("ENONPMTOKEN", { registry });
     throw new AggregateError([semanticError], semanticError.message);
   }
 };
 
+const debug$2 = dbg("semantic-release-pnpm:verify-auth");
 const isConnectionError = (error) => {
   const errorMessage = error instanceof Error ? error.message : String(error);
   const errorCode = error?.code || "";
@@ -526,8 +590,15 @@ const verifyAuthContextAgainstCustomRegistry = async (npmrc, registry, context,
 };
 const verifyAuth = async (npmrc, package_, context, pkgRoot) => {
   const registry = getRegistry(package_, context);
-  if (package_.name && await oidcContext(registry, package_, context)) {
-    return;
+  if (package_.name) {
+    debug$2(`Checking OIDC trusted publishing for package "${package_.name}" on registry "${registry}"`);
+    if (await oidcContext(registry, package_, context)) {
+      debug$2("OIDC trusted publishing verified successfully, skipping NPM_TOKEN check");
+      return;
+    }
+    debug$2("OIDC trusted publishing not available, falling back to NPM_TOKEN authentication");
+  } else {
+    debug$2("Package name not found, skipping OIDC check and using NPM_TOKEN authentication");
   }
   await setNpmrcAuth(npmrc, registry, context);
   const normalizedRegistry = normalizeUrl(registry);
@@ -567,14 +638,18 @@ const verifyConfig = (config) => (
   }, [])
 );
 
+const debug$1 = dbg("semantic-release-pnpm:verify-pnpm");
 const MIN_PNPM_VERSION = "8.0.0";
 const verifyPnpm = async ({ logger }) => {
   logger.log(`Verify pnpm version is >= ${MIN_PNPM_VERSION}`);
   const version = getPackageManagerVersion("pnpm");
+  debug$1(`Detected pnpm version: ${String(version)}`);
   if (gte(MIN_PNPM_VERSION, version)) {
+    debug$1(`pnpm version ${String(version)} is below minimum required version ${MIN_PNPM_VERSION}`);
     const semanticError = getError("EINVALIDPNPM", { version: String(version) });
     throw new AggregateError([semanticError], semanticError.message);
   }
+  debug$1(`pnpm version ${String(version)} meets minimum requirement (>= ${MIN_PNPM_VERSION})`);
 };
 
 const verify = async (pluginConfig, context) => {
@@ -590,8 +665,11 @@ const verify = async (pluginConfig, context) => {
   try {
     const packageJson = await getPackage(pluginConfig, context);
     if (shouldPublish(pluginConfig, packageJson)) {
+      context.logger.log(`Verifying authentication for package "${packageJson.name ?? "unknown"}"`);
       const npmrc = getNpmrcPath(context.cwd, context.env);
       await verifyAuth(npmrc, packageJson, context, pluginConfig.pkgRoot);
+    } else {
+      context.logger.log(`Skipping authentication verification for package "${packageJson.name ?? "unknown"}" (publishing disabled)`);
     }
   } catch (error) {
     const typedError = error;
@@ -603,6 +681,7 @@ const verify = async (pluginConfig, context) => {
   }
 };
 
+const debug = dbg("semantic-release-pnpm:index");
 const PLUGIN_NAME = "semantic-release-pnpm";
 let verified;
 let prepared;
@@ -620,7 +699,10 @@ const verifyConditions = async (pluginConfig, context) => {
   verified = true;
 };
 const prepare = async (pluginConfig, context) => {
-  if (!verified) {
+  if (verified) {
+    debug("Skipping verifyConditions (already verified)");
+  } else {
+    debug("Verification not cached, running verifyConditions");
     await verify(pluginConfig, context);
   }
   await prepare$1(pluginConfig, context);
@@ -628,16 +710,25 @@ const prepare = async (pluginConfig, context) => {
 };
 const publish = async (pluginConfig, context) => {
   const packageJson = await getPackage(pluginConfig, context);
-  if (!verified) {
+  if (verified) {
+    debug("Skipping verifyConditions (already verified)");
+  } else {
+    debug("Verification not cached, running verifyConditions");
     await verify(pluginConfig, context);
   }
-  if (!prepared) {
+  if (prepared) {
+    debug("Skipping prepare (already prepared)");
+  } else {
+    debug("Preparation not cached, running prepare");
     await prepare$1(pluginConfig, context);
   }
   return await publish$1(pluginConfig, packageJson, context);
 };
 const addChannel = async (pluginConfig, context) => {
-  if (!verified) {
+  if (verified) {
+    debug("Skipping verifyConditions (already verified)");
+  } else {
+    debug("Verification not cached, running verifyConditions");
     await verify(pluginConfig, context);
   }
   const packageJson = await getPackage(pluginConfig, context);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anolilab/semantic-release-pnpm",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "description": "Semantic-release plugin to publish a npm package with pnpm.",
   "keywords": [
     "anolilab",
@@ -10,7 +10,21 @@
     "monorepo",
     "semantic-release",
     "semantic-release-plugin",
-    "semantic-release-pnpm"
+    "semantic-release-pnpm",
+    "registry",
+    "npmjs",
+    "npm-registry",
+    "package-manager",
+    "workspace",
+    "workspaces",
+    "trusted-publishing",
+    "otp",
+    "authentication",
+    "npm-publish",
+    "package-publish",
+    "release-plugin",
+    "ci-cd",
+    "automation"
   ],
   "homepage": "https://github.com/anolilab/semantic-release/tree/main/packages/semantic-release-pnpm",
   "bugs": {
@@ -47,13 +61,14 @@
   ],
   "dependencies": {
     "@actions/core": "^1.11.1",
-    "@anolilab/rc": "3.1.0",
+    "@anolilab/rc": "3.2.0",
     "@semantic-release/error": "^4.0.0",
     "@visulima/fs": "^4.1.0",
     "@visulima/package": "^4.1.7",
     "@visulima/path": "^2.0.5",
+    "debug": "^4.4.3",
     "env-ci": "^11.2.0",
-    "execa": "^9.6.0",
+    "execa": "^9.6.1",
     "ini": "^6.0.0",
     "normalize-url": "^8.1.0",
     "registry-auth-token": "^5.1.0",