@anolilab/semantic-release-pnpm 3.2.0 → 3.2.1

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## @anolilab/semantic-release-pnpm [3.2.1](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.2.0...@anolilab/semantic-release-pnpm@3.2.1) (2025-12-05)
+
+### Bug Fixes
+
+* implement caching for whoami results in verifyAuth ([e8a482f](https://github.com/anolilab/semantic-release/commit/e8a482fec317dc829f9a373804b99110abafd1b2))
+
 ## @anolilab/semantic-release-pnpm [3.2.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.1.0...@anolilab/semantic-release-pnpm@3.2.0) (2025-12-04)
 
 ### Bug Fixes

package/README.md

@@ -76,6 +76,7 @@ When publishing to the [official registry](https://registry.npmjs.org/), it is r
 
 > [!IMPORTANT]
 > **First-time releases with OIDC**: npm requires a package to exist before you can configure OIDC trusted publishing. If you're releasing a package for the first time with OIDC, you have two options:
+>
 > 1. Publish a dummy version manually first (e.g., `pnpm publish --tag dummy`), then configure OIDC trusted publishing, and then use semantic-release for subsequent releases.
 > 2. Use the [`setup-npm-trusted-publish`](https://github.com/azu/setup-npm-trusted-publish) tool to automatically create and publish a placeholder package for OIDC setup purposes.
 >

package/dist/index.js

@@ -26,10 +26,10 @@ import { rc } from '@anolilab/rc';
 import normalizeUrl from 'normalize-url';
 import { findPackageJson, getPackageManagerVersion } from '@visulima/package';
 import SemanticReleaseError from '@semantic-release/error';
+import getAuthToken from 'registry-auth-token';
 import { getIDToken } from '@actions/core';
 import envCi from 'env-ci';
 import { stringify } from 'ini';
-import getAuthToken from 'registry-auth-token';
 const {
   URL
 } = __cjs_getBuiltinModule("node:url");
@@ -502,6 +502,34 @@ email = \${NPM_EMAIL}`
 };
 
 const debug$2 = dbg("semantic-release-pnpm:verify-auth");
+const whoamiCache = /* @__PURE__ */ new Map();
+const getCacheKey = (registry, context) => {
+  const normalizedRegistry = normalizeUrl(registry);
+  const {
+    env: { NPM_PASSWORD, NPM_TOKEN, NPM_USERNAME }
+  } = context;
+  if (NPM_TOKEN) {
+    const tokenId = NPM_TOKEN.length > 12 ? `${NPM_TOKEN.slice(0, 8)}...${NPM_TOKEN.slice(-4)}` : NPM_TOKEN.slice(0, 8);
+    return `${normalizedRegistry}:token:${tokenId}`;
+  }
+  if (NPM_USERNAME && NPM_PASSWORD) {
+    return `${normalizedRegistry}:user:${NPM_USERNAME}`;
+  }
+  try {
+    const { config } = rc("npm", {
+      config: context.env.NPM_CONFIG_USERCONFIG ?? resolve(context.cwd, ".npmrc"),
+      cwd: context.cwd,
+      defaults: { registry: OFFICIAL_REGISTRY }
+    });
+    const token = getAuthToken(registry, { npmrc: config });
+    if (token) {
+      const tokenId = token.length > 12 ? `${token.slice(0, 8)}...${token.slice(-4)}` : token.slice(0, 8);
+      return `${normalizedRegistry}:token:${tokenId}`;
+    }
+  } catch {
+  }
+  return `${normalizedRegistry}:default`;
+};
 const isConnectionError = (error) => {
   const errorMessage = error instanceof Error ? error.message : String(error);
   const errorCode = error?.code || "";
@@ -509,32 +537,55 @@ const isConnectionError = (error) => {
   return isTimedOut || errorCode === "ECONNREFUSED" || errorCode === "ETIMEDOUT" || errorMessage.includes("ECONNREFUSED") || errorMessage.includes("ETIMEDOUT") || errorMessage.includes("getaddrinfo ENOTFOUND") || errorMessage.includes("timed out");
 };
 const verifyAuthContextAgainstRegistry = async (npmrc, registry, context) => {
-  const { cwd, env, logger, stderr, stdout } = context;
-  try {
-    logger.log(`Running "pnpm whoami" to verify authentication on registry "${registry}"`);
-    const whoamiResult = await execa("pnpm", ["whoami", "--registry", registry], {
-      cwd,
-      env: {
-        ...env,
-        NPM_CONFIG_USERCONFIG: npmrc
-      },
-      preferLocal: true,
-      timeout: 5e3
-      // 5 second timeout to prevent hanging when registry is unavailable
-    });
-    if (whoamiResult.stdout) {
-      stdout.write(whoamiResult.stdout);
+  const cacheKey = getCacheKey(registry, context);
+  if (whoamiCache.has(cacheKey)) {
+    debug$2(`Using cached whoami result for registry "${registry}"`);
+    const cachedResult = whoamiCache.get(cacheKey);
+    try {
+      await cachedResult;
+      return;
+    } catch {
+      debug$2(`Cached whoami result failed, retrying for registry "${registry}"`);
+      whoamiCache.delete(cacheKey);
     }
-    if (whoamiResult.stderr) {
-      stderr.write(whoamiResult.stderr);
+  }
+  const verificationPromise = (async () => {
+    const { cwd, env, logger, stderr, stdout } = context;
+    try {
+      logger.log(`Running "pnpm whoami" to verify authentication on registry "${registry}"`);
+      const whoamiResult = await execa("pnpm", ["whoami", "--registry", registry], {
+        cwd,
+        env: {
+          ...env,
+          NPM_CONFIG_USERCONFIG: npmrc
+        },
+        preferLocal: true,
+        timeout: 5e3
+        // 5 second timeout to prevent hanging when registry is unavailable
+      });
+      if (whoamiResult.stdout) {
+        stdout.write(whoamiResult.stdout);
+      }
+      if (whoamiResult.stderr) {
+        stderr.write(whoamiResult.stderr);
+      }
+    } catch (error) {
+      if (isConnectionError(error)) {
+        const semanticError2 = getError("EINVALIDNPMAUTH", { registry });
+        throw new AggregateError([semanticError2], semanticError2.message);
+      }
+      const semanticError = getError("EINVALIDNPMTOKEN", { registry });
+      throw new AggregateError([semanticError], semanticError.message);
     }
+  })();
+  whoamiCache.set(cacheKey, verificationPromise);
+  try {
+    await verificationPromise;
   } catch (error) {
     if (isConnectionError(error)) {
-      const semanticError2 = getError("EINVALIDNPMAUTH", { registry });
-      throw new AggregateError([semanticError2], semanticError2.message);
+      whoamiCache.delete(cacheKey);
     }
-    const semanticError = getError("EINVALIDNPMTOKEN", { registry });
-    throw new AggregateError([semanticError], semanticError.message);
+    throw error;
   }
 };
 const isAuthErrorMessage = (message) => message.includes("requires you to be logged in") || message.includes("authentication") || message.includes("Unauthorized") || message.includes("401") || message.includes("403");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anolilab/semantic-release-pnpm",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "description": "Semantic-release plugin to publish a npm package with pnpm.",
   "keywords": [
     "anolilab",