@anolilab/semantic-release-pnpm 3.2.0 → 3.2.2

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## @anolilab/semantic-release-pnpm [3.2.2](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.2.1...@anolilab/semantic-release-pnpm@3.2.2) (2025-12-05)
+
+### Bug Fixes
+
+* enhance OIDC authentication handling in verifyAuth ([0141c07](https://github.com/anolilab/semantic-release/commit/0141c07cc4a0457b4aa01ecade582c40d17ef205))
+
+## @anolilab/semantic-release-pnpm [3.2.1](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.2.0...@anolilab/semantic-release-pnpm@3.2.1) (2025-12-05)
+
+### Bug Fixes
+
+* implement caching for whoami results in verifyAuth ([e8a482f](https://github.com/anolilab/semantic-release/commit/e8a482fec317dc829f9a373804b99110abafd1b2))
+
 ## @anolilab/semantic-release-pnpm [3.2.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.1.0...@anolilab/semantic-release-pnpm@3.2.0) (2025-12-04)
 
 ### Bug Fixes

package/README.md

@@ -53,7 +53,7 @@ The plugin can be configured in the [**semantic-release** configuration file](ht
 
 | Step               | Description                                                                                                                      |
 | ------------------ | -------------------------------------------------------------------------------------------------------------------------------- |
-| `verifyConditions` | Verify the presence of the `NPM_TOKEN` environment variable, or an `.npmrc` file, and verify the authentication method is valid. |
+| `verifyConditions` | Verify the presence of the `NPM_TOKEN` environment variable, or an `.npmrc` file, and verify the authentication method is valid. Results are cached per registry/auth combination to prevent throttling in monorepos. |
 | `prepare`          | Update the `package.json` version and [create](https://docs.npmjs.com/cli/pack) the npm package tarball.                         |
 | `addChannel`       | [Add a release to a dist-tag](https://docs.npmjs.com/cli/dist-tag).                                                              |
 | `publish`          | [Publish the npm package](https://docs.npmjs.com/cli/publish) to the registry.                                                   |
@@ -76,11 +76,15 @@ When publishing to the [official registry](https://registry.npmjs.org/), it is r
 
 > [!IMPORTANT]
 > **First-time releases with OIDC**: npm requires a package to exist before you can configure OIDC trusted publishing. If you're releasing a package for the first time with OIDC, you have two options:
+>
 > 1. Publish a dummy version manually first (e.g., `pnpm publish --tag dummy`), then configure OIDC trusted publishing, and then use semantic-release for subsequent releases.
 > 2. Use the [`setup-npm-trusted-publish`](https://github.com/azu/setup-npm-trusted-publish) tool to automatically create and publish a placeholder package for OIDC setup purposes.
 >
 > After the initial package exists, you can configure OIDC trusted publishing at `https://www.npmjs.com/package/<package-name>/access` and then use semantic-release for all future releases.
 
+> [!TIP]
+> **Monorepo Performance**: The plugin automatically caches authentication verification results per registry/auth token combination. This prevents throttling when verifying multiple packages in monorepos, as `pnpm whoami` is only called once per unique registry/authentication context rather than once per package.
+
 ##### Trusted publishing from GitHub Actions
 
 To leverage trusted publishing and publish with provenance from GitHub Actions, the `id-token: write` permission is required to be enabled on the job:

package/dist/index.js

@@ -26,10 +26,10 @@ import { rc } from '@anolilab/rc';
 import normalizeUrl from 'normalize-url';
 import { findPackageJson, getPackageManagerVersion } from '@visulima/package';
 import SemanticReleaseError from '@semantic-release/error';
-import { getIDToken } from '@actions/core';
-import envCi from 'env-ci';
 import { stringify } from 'ini';
 import getAuthToken from 'registry-auth-token';
+import { getIDToken } from '@actions/core';
+import envCi from 'env-ci';
 const {
   URL
 } = __cjs_getBuiltinModule("node:url");
@@ -502,6 +502,34 @@ email = \${NPM_EMAIL}`
 };
 
 const debug$2 = dbg("semantic-release-pnpm:verify-auth");
+const whoamiCache = /* @__PURE__ */ new Map();
+const getCacheKey = (registry, context) => {
+  const normalizedRegistry = normalizeUrl(registry);
+  const {
+    env: { NPM_PASSWORD, NPM_TOKEN, NPM_USERNAME }
+  } = context;
+  if (NPM_TOKEN) {
+    const tokenId = NPM_TOKEN.length > 12 ? `${NPM_TOKEN.slice(0, 8)}...${NPM_TOKEN.slice(-4)}` : NPM_TOKEN.slice(0, 8);
+    return `${normalizedRegistry}:token:${tokenId}`;
+  }
+  if (NPM_USERNAME && NPM_PASSWORD) {
+    return `${normalizedRegistry}:user:${NPM_USERNAME}`;
+  }
+  try {
+    const { config } = rc("npm", {
+      config: context.env.NPM_CONFIG_USERCONFIG ?? resolve(context.cwd, ".npmrc"),
+      cwd: context.cwd,
+      defaults: { registry: OFFICIAL_REGISTRY }
+    });
+    const token = getAuthToken(registry, { npmrc: config });
+    if (token) {
+      const tokenId = token.length > 12 ? `${token.slice(0, 8)}...${token.slice(-4)}` : token.slice(0, 8);
+      return `${normalizedRegistry}:token:${tokenId}`;
+    }
+  } catch {
+  }
+  return `${normalizedRegistry}:default`;
+};
 const isConnectionError = (error) => {
   const errorMessage = error instanceof Error ? error.message : String(error);
   const errorCode = error?.code || "";
@@ -509,32 +537,55 @@ const isConnectionError = (error) => {
   return isTimedOut || errorCode === "ECONNREFUSED" || errorCode === "ETIMEDOUT" || errorMessage.includes("ECONNREFUSED") || errorMessage.includes("ETIMEDOUT") || errorMessage.includes("getaddrinfo ENOTFOUND") || errorMessage.includes("timed out");
 };
 const verifyAuthContextAgainstRegistry = async (npmrc, registry, context) => {
-  const { cwd, env, logger, stderr, stdout } = context;
-  try {
-    logger.log(`Running "pnpm whoami" to verify authentication on registry "${registry}"`);
-    const whoamiResult = await execa("pnpm", ["whoami", "--registry", registry], {
-      cwd,
-      env: {
-        ...env,
-        NPM_CONFIG_USERCONFIG: npmrc
-      },
-      preferLocal: true,
-      timeout: 5e3
-      // 5 second timeout to prevent hanging when registry is unavailable
-    });
-    if (whoamiResult.stdout) {
-      stdout.write(whoamiResult.stdout);
+  const cacheKey = getCacheKey(registry, context);
+  if (whoamiCache.has(cacheKey)) {
+    debug$2(`Using cached whoami result for registry "${registry}"`);
+    const cachedResult = whoamiCache.get(cacheKey);
+    try {
+      await cachedResult;
+      return;
+    } catch {
+      debug$2(`Cached whoami result failed, retrying for registry "${registry}"`);
+      whoamiCache.delete(cacheKey);
     }
-    if (whoamiResult.stderr) {
-      stderr.write(whoamiResult.stderr);
+  }
+  const verificationPromise = (async () => {
+    const { cwd, env, logger, stderr, stdout } = context;
+    try {
+      logger.log(`Running "pnpm whoami" to verify authentication on registry "${registry}"`);
+      const whoamiResult = await execa("pnpm", ["whoami", "--registry", registry], {
+        cwd,
+        env: {
+          ...env,
+          NPM_CONFIG_USERCONFIG: npmrc
+        },
+        preferLocal: true,
+        timeout: 5e3
+        // 5 second timeout to prevent hanging when registry is unavailable
+      });
+      if (whoamiResult.stdout) {
+        stdout.write(whoamiResult.stdout);
+      }
+      if (whoamiResult.stderr) {
+        stderr.write(whoamiResult.stderr);
+      }
+    } catch (error) {
+      if (isConnectionError(error)) {
+        const semanticError2 = getError("EINVALIDNPMAUTH", { registry });
+        throw new AggregateError([semanticError2], semanticError2.message);
+      }
+      const semanticError = getError("EINVALIDNPMTOKEN", { registry });
+      throw new AggregateError([semanticError], semanticError.message);
     }
+  })();
+  whoamiCache.set(cacheKey, verificationPromise);
+  try {
+    await verificationPromise;
   } catch (error) {
     if (isConnectionError(error)) {
-      const semanticError2 = getError("EINVALIDNPMAUTH", { registry });
-      throw new AggregateError([semanticError2], semanticError2.message);
+      whoamiCache.delete(cacheKey);
     }
-    const semanticError = getError("EINVALIDNPMTOKEN", { registry });
-    throw new AggregateError([semanticError], semanticError.message);
+    throw error;
   }
 };
 const isAuthErrorMessage = (message) => message.includes("requires you to be logged in") || message.includes("authentication") || message.includes("Unauthorized") || message.includes("401") || message.includes("403");
@@ -593,10 +644,24 @@ const verifyAuth = async (npmrc, package_, context, pkgRoot) => {
   if (package_.name) {
     debug$2(`Checking OIDC trusted publishing for package "${package_.name}" on registry "${registry}"`);
     if (await oidcContext(registry, package_, context)) {
-      debug$2("OIDC trusted publishing verified successfully, skipping NPM_TOKEN check");
-      return;
+      debug$2("OIDC trusted publishing verified successfully, exchanging token for npmrc");
+      const oidcToken = await tokenExchange({ name: package_.name }, context);
+      if (oidcToken) {
+        const { config } = rc("npm", {
+          config: context.env.NPM_CONFIG_USERCONFIG ?? resolve(context.cwd, ".npmrc"),
+          cwd: context.cwd,
+          defaults: { registry: OFFICIAL_REGISTRY }
+        });
+        await writeFile(npmrc, `${Object.keys(config).length > 0 ? `${stringify(config)}
+` : ""}${nerfDart(registry)}:_authToken = ${oidcToken}`);
+        debug$2(`Wrote OIDC-exchanged token to ${npmrc} for use during publish`);
+        context.logger.log(`OIDC trusted publishing configured for package "${package_.name}"`);
+        return;
+      }
+      debug$2("OIDC token exchange failed, falling back to NPM_TOKEN authentication");
+    } else {
+      debug$2("OIDC trusted publishing not available, falling back to NPM_TOKEN authentication");
     }
-    debug$2("OIDC trusted publishing not available, falling back to NPM_TOKEN authentication");
   } else {
     debug$2("Package name not found, skipping OIDC check and using NPM_TOKEN authentication");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anolilab/semantic-release-pnpm",
-  "version": "3.2.0",
+  "version": "3.2.2",
   "description": "Semantic-release plugin to publish a npm package with pnpm.",
   "keywords": [
     "anolilab",