@anolilab/semantic-release-pnpm 3.2.1 → 3.2.2

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## @anolilab/semantic-release-pnpm [3.2.2](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.2.1...@anolilab/semantic-release-pnpm@3.2.2) (2025-12-05)
+
+### Bug Fixes
+
+* enhance OIDC authentication handling in verifyAuth ([0141c07](https://github.com/anolilab/semantic-release/commit/0141c07cc4a0457b4aa01ecade582c40d17ef205))
+
 ## @anolilab/semantic-release-pnpm [3.2.1](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.2.0...@anolilab/semantic-release-pnpm@3.2.1) (2025-12-05)
 
 ### Bug Fixes

package/README.md

@@ -53,7 +53,7 @@ The plugin can be configured in the [**semantic-release** configuration file](ht
 
 | Step               | Description                                                                                                                      |
 | ------------------ | -------------------------------------------------------------------------------------------------------------------------------- |
-| `verifyConditions` | Verify the presence of the `NPM_TOKEN` environment variable, or an `.npmrc` file, and verify the authentication method is valid. |
+| `verifyConditions` | Verify the presence of the `NPM_TOKEN` environment variable, or an `.npmrc` file, and verify the authentication method is valid. Results are cached per registry/auth combination to prevent throttling in monorepos. |
 | `prepare`          | Update the `package.json` version and [create](https://docs.npmjs.com/cli/pack) the npm package tarball.                         |
 | `addChannel`       | [Add a release to a dist-tag](https://docs.npmjs.com/cli/dist-tag).                                                              |
 | `publish`          | [Publish the npm package](https://docs.npmjs.com/cli/publish) to the registry.                                                   |
@@ -82,6 +82,9 @@ When publishing to the [official registry](https://registry.npmjs.org/), it is r
 >
 > After the initial package exists, you can configure OIDC trusted publishing at `https://www.npmjs.com/package/<package-name>/access` and then use semantic-release for all future releases.
 
+> [!TIP]
+> **Monorepo Performance**: The plugin automatically caches authentication verification results per registry/auth token combination. This prevents throttling when verifying multiple packages in monorepos, as `pnpm whoami` is only called once per unique registry/authentication context rather than once per package.
+
 ##### Trusted publishing from GitHub Actions
 
 To leverage trusted publishing and publish with provenance from GitHub Actions, the `id-token: write` permission is required to be enabled on the job:

package/dist/index.js

@@ -26,10 +26,10 @@ import { rc } from '@anolilab/rc';
 import normalizeUrl from 'normalize-url';
 import { findPackageJson, getPackageManagerVersion } from '@visulima/package';
 import SemanticReleaseError from '@semantic-release/error';
+import { stringify } from 'ini';
 import getAuthToken from 'registry-auth-token';
 import { getIDToken } from '@actions/core';
 import envCi from 'env-ci';
-import { stringify } from 'ini';
 const {
   URL
 } = __cjs_getBuiltinModule("node:url");
@@ -644,10 +644,24 @@ const verifyAuth = async (npmrc, package_, context, pkgRoot) => {
   if (package_.name) {
     debug$2(`Checking OIDC trusted publishing for package "${package_.name}" on registry "${registry}"`);
     if (await oidcContext(registry, package_, context)) {
-      debug$2("OIDC trusted publishing verified successfully, skipping NPM_TOKEN check");
-      return;
+      debug$2("OIDC trusted publishing verified successfully, exchanging token for npmrc");
+      const oidcToken = await tokenExchange({ name: package_.name }, context);
+      if (oidcToken) {
+        const { config } = rc("npm", {
+          config: context.env.NPM_CONFIG_USERCONFIG ?? resolve(context.cwd, ".npmrc"),
+          cwd: context.cwd,
+          defaults: { registry: OFFICIAL_REGISTRY }
+        });
+        await writeFile(npmrc, `${Object.keys(config).length > 0 ? `${stringify(config)}
+` : ""}${nerfDart(registry)}:_authToken = ${oidcToken}`);
+        debug$2(`Wrote OIDC-exchanged token to ${npmrc} for use during publish`);
+        context.logger.log(`OIDC trusted publishing configured for package "${package_.name}"`);
+        return;
+      }
+      debug$2("OIDC token exchange failed, falling back to NPM_TOKEN authentication");
+    } else {
+      debug$2("OIDC trusted publishing not available, falling back to NPM_TOKEN authentication");
     }
-    debug$2("OIDC trusted publishing not available, falling back to NPM_TOKEN authentication");
   } else {
     debug$2("Package name not found, skipping OIDC check and using NPM_TOKEN authentication");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anolilab/semantic-release-pnpm",
-  "version": "3.2.1",
+  "version": "3.2.2",
   "description": "Semantic-release plugin to publish a npm package with pnpm.",
   "keywords": [
     "anolilab",