@anolilab/semantic-release-pnpm 3.2.1 → 4.0.0-alpha.1

package/CHANGELOG.md

@@ -1,3 +1,20 @@
+## @anolilab/semantic-release-pnpm [4.0.0-alpha.1](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.2.2...@anolilab/semantic-release-pnpm@4.0.0-alpha.1) (2025-12-09)
+
+### Bug Fixes
+
+* add GitHub labeler configuration and update package metadata ([dce9314](https://github.com/anolilab/semantic-release/commit/dce9314ca6aefaf86e75c6d065cdac8ad7a60717))
+
+
+### Dependencies
+
+* **@anolilab/rc:** upgraded to 3.2.1-alpha.1
+
+## @anolilab/semantic-release-pnpm [3.2.2](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.2.1...@anolilab/semantic-release-pnpm@3.2.2) (2025-12-05)
+
+### Bug Fixes
+
+* enhance OIDC authentication handling in verifyAuth ([0141c07](https://github.com/anolilab/semantic-release/commit/0141c07cc4a0457b4aa01ecade582c40d17ef205))
+
 ## @anolilab/semantic-release-pnpm [3.2.1](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@3.2.0...@anolilab/semantic-release-pnpm@3.2.1) (2025-12-05)
 
 ### Bug Fixes

package/README.md

@@ -1,15 +1,24 @@
-<div align="center">
-  <h3>anolilab semantic-release-pnpm</h3>
-  <p>
-  Semantic-release plugin to publish a npm package with pnpm.
-  </p>
-</div>
+<!-- START_PACKAGE_OG_IMAGE_PLACEHOLDER -->
+
+<a href="https://github.com/anolilab/semantic-release" align="center">
+
+  <img src="__assets__/package-og.svg" alt="semantic-release-pnpm" />
+
+</a>
+
+<h3 align="center">Semantic-release plugin to publish a npm package with pnpm.</h3>
+
+<!-- END_PACKAGE_OG_IMAGE_PLACEHOLDER -->
 
 <br />
 
 <div align="center">
 
-[![typescript-image]][typescript-url] [![npm-image]][npm-url] [![license-image]][license-url]
+[![typescript-image][typescript-badge]][typescript-url]
+[![mit licence][license-badge]][license]
+[![npm downloads][npm-downloads-badge]][npm-downloads]
+[![Chat][chat-badge]][chat]
+[![PRs Welcome][prs-welcome-badge]][prs-welcome]
 
 </div>
 
@@ -53,7 +62,7 @@ The plugin can be configured in the [**semantic-release** configuration file](ht
 
 | Step               | Description                                                                                                                      |
 | ------------------ | -------------------------------------------------------------------------------------------------------------------------------- |
-| `verifyConditions` | Verify the presence of the `NPM_TOKEN` environment variable, or an `.npmrc` file, and verify the authentication method is valid. |
+| `verifyConditions` | Verify the presence of the `NPM_TOKEN` environment variable, or an `.npmrc` file, and verify the authentication method is valid. Results are cached per registry/auth combination to prevent throttling in monorepos. |
 | `prepare`          | Update the `package.json` version and [create](https://docs.npmjs.com/cli/pack) the npm package tarball.                         |
 | `addChannel`       | [Add a release to a dist-tag](https://docs.npmjs.com/cli/dist-tag).                                                              |
 | `publish`          | [Publish the npm package](https://docs.npmjs.com/cli/publish) to the registry.                                                   |
@@ -82,6 +91,9 @@ When publishing to the [official registry](https://registry.npmjs.org/), it is r
 >
 > After the initial package exists, you can configure OIDC trusted publishing at `https://www.npmjs.com/package/<package-name>/access` and then use semantic-release for all future releases.
 
+> [!TIP]
+> **Monorepo Performance**: The plugin automatically caches authentication verification results per registry/auth token combination. This prevents throttling when verifying multiple packages in monorepos, as `pnpm whoami` is only called once per unique registry/authentication context rather than once per package.
+
 ##### Trusted publishing from GitHub Actions
 
 To leverage trusted publishing and publish with provenance from GitHub Actions, the `id-token: write` permission is required to be enabled on the job:
@@ -263,13 +275,24 @@ If you would like to help take a look at the [list of issues](https://github.com
 - [Daniel Bannert](https://github.com/prisis)
 - [All Contributors](https://github.com/anolilab/semantic-release/graphs/contributors)
 
+## Made with ❤️ at Anolilab
+
+This is an open source project and will always remain free to use. If you think it's cool, please star it 🌟. [Anolilab](https://www.anolilab.com/open-source) is a Development and AI Studio. Contact us at [hello@anolilab.com](mailto:hello@anolilab.com) if you need any help with these technologies or just want to say hi!
+
 ## License
 
 The anolilab semantic-release-pnpm is open-sourced software licensed under the [MIT][license-url]
 
-[typescript-image]: https://img.shields.io/badge/Typescript-294E80.svg?style=for-the-badge&logo=typescript
-[typescript-url]: "typescript"
-[license-image]: https://img.shields.io/npm/l/@anolilab/semantic-release-pnpm?color=blueviolet&style=for-the-badge
-[license-url]: LICENSE.md "license"
-[npm-image]: https://img.shields.io/npm/v/@anolilab/semantic-release-pnpm/latest.svg?style=for-the-badge&logo=npm
-[npm-url]: https://www.npmjs.com/package/@anolilab/semantic-release-pnpm/v/latest "npm"
+<!-- badges -->
+
+[license-badge]: https://img.shields.io/npm/l/@anolilab/semantic-release-pnpm?style=for-the-badge
+[license]: https://github.com/anolilab/multi-semantic-release/blob/main/LICENSE
+[npm-downloads-badge]: https://img.shields.io/npm/dm/@anolilab/semantic-release-pnpm?style=for-the-badge
+[npm-downloads]: https://www.npmjs.com/package/@anolilab/semantic-release-pnpm
+[prs-welcome-badge]: https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=for-the-badge
+[prs-welcome]: https://github.com/anolilab/multi-semantic-release/blob/main/.github/CONTRIBUTING.md
+[chat-badge]: https://img.shields.io/discord/902465130518949899.svg?style=for-the-badge
+[chat]: https://discord.gg/TtFJY8xkFK
+[typescript-badge]: https://img.shields.io/badge/Typescript-294E80.svg?style=for-the-badge&logo=typescript
+[typescript-url]: https://www.typescriptlang.org/
+[license-url]: LICENSE.md

package/dist/index.js

@@ -26,10 +26,10 @@ import { rc } from '@anolilab/rc';
 import normalizeUrl from 'normalize-url';
 import { findPackageJson, getPackageManagerVersion } from '@visulima/package';
 import SemanticReleaseError from '@semantic-release/error';
+import { stringify } from 'ini';
 import getAuthToken from 'registry-auth-token';
 import { getIDToken } from '@actions/core';
 import envCi from 'env-ci';
-import { stringify } from 'ini';
 const {
   URL
 } = __cjs_getBuiltinModule("node:url");
@@ -644,10 +644,24 @@ const verifyAuth = async (npmrc, package_, context, pkgRoot) => {
   if (package_.name) {
     debug$2(`Checking OIDC trusted publishing for package "${package_.name}" on registry "${registry}"`);
     if (await oidcContext(registry, package_, context)) {
-      debug$2("OIDC trusted publishing verified successfully, skipping NPM_TOKEN check");
-      return;
+      debug$2("OIDC trusted publishing verified successfully, exchanging token for npmrc");
+      const oidcToken = await tokenExchange({ name: package_.name }, context);
+      if (oidcToken) {
+        const { config } = rc("npm", {
+          config: context.env.NPM_CONFIG_USERCONFIG ?? resolve(context.cwd, ".npmrc"),
+          cwd: context.cwd,
+          defaults: { registry: OFFICIAL_REGISTRY }
+        });
+        await writeFile(npmrc, `${Object.keys(config).length > 0 ? `${stringify(config)}
+` : ""}${nerfDart(registry)}:_authToken = ${oidcToken}`);
+        debug$2(`Wrote OIDC-exchanged token to ${npmrc} for use during publish`);
+        context.logger.log(`OIDC trusted publishing configured for package "${package_.name}"`);
+        return;
+      }
+      debug$2("OIDC token exchange failed, falling back to NPM_TOKEN authentication");
+    } else {
+      debug$2("OIDC trusted publishing not available, falling back to NPM_TOKEN authentication");
     }
-    debug$2("OIDC trusted publishing not available, falling back to NPM_TOKEN authentication");
   } else {
     debug$2("Package name not found, skipping OIDC check and using NPM_TOKEN authentication");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anolilab/semantic-release-pnpm",
-  "version": "3.2.1",
+  "version": "4.0.0-alpha.1",
   "description": "Semantic-release plugin to publish a npm package with pnpm.",
   "keywords": [
     "anolilab",
@@ -60,8 +60,8 @@
     "dist"
   ],
   "dependencies": {
-    "@actions/core": "^1.11.1",
-    "@anolilab/rc": "3.2.0",
+    "@actions/core": "^2.0.0",
+    "@anolilab/rc": "3.2.1-alpha.1",
     "@semantic-release/error": "^4.0.0",
     "@visulima/fs": "^4.1.0",
     "@visulima/package": "^4.1.7",