@anolilab/semantic-release-pnpm 6.0.0 → 8.0.0

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+## @anolilab/semantic-release-pnpm [8.0.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@7.0.0...@anolilab/semantic-release-pnpm@8.0.0) (2026-04-08)
+
+### Bug Fixes
+
+* **semantic-release-pnpm:** false EINVALIDNPMAUTH on successful dry-run publish ([ccb0475](https://github.com/anolilab/semantic-release/commit/ccb04758a6b3cf7176f5ea6a5081a0ec239c3e0e)), closes [anolilab/semantic-release#278](https://github.com/anolilab/semantic-release/issues/278)
+* **semantic-release-pnpm:** fix type errors and resolve all ESLint violations ([943e416](https://github.com/anolilab/semantic-release/commit/943e41694917a5a94c3d7f629acd198d7e37b592))
+* **semantic-release-pnpm:** fix verify-auth test and resolve ESLint violations ([9f38380](https://github.com/anolilab/semantic-release/commit/9f383802f58df3ceb13c46b570853c309ee95357))
+
+
+### Dependencies
+
+* **@anolilab/rc:** upgraded to 4.0.1
+
+## @anolilab/semantic-release-pnpm [7.0.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@6.0.0...@anolilab/semantic-release-pnpm@7.0.0) (2026-04-07)
+
 ## @anolilab/semantic-release-pnpm [6.0.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@5.0.0...@anolilab/semantic-release-pnpm@6.0.0) (2026-04-07)
 
 ## @anolilab/semantic-release-pnpm [5.0.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@4.1.0...@anolilab/semantic-release-pnpm@5.0.0) (2026-02-02)

package/dist/index.d.ts

@@ -1,22 +1,22 @@
 import stream from 'node:stream';
 
 interface BranchObject {
-    channel?: string | false | undefined;
+    channel?: string | false;
     name: string;
-    prerelease?: boolean | string | undefined;
-    range?: string | undefined;
+    prerelease?: boolean | string;
+    range?: string;
 }
 type BranchSpec$1 = BranchObject | string;
 type PluginSpec<T = any> = string | [string, T];
 interface Options {
     [name: string]: any;
-    branches?: BranchSpec$1 | ReadonlyArray<BranchSpec$1> | undefined;
-    ci?: boolean | undefined;
-    dryRun?: boolean | undefined;
-    extends?: ReadonlyArray<string> | string | undefined;
-    plugins?: ReadonlyArray<PluginSpec> | undefined;
-    repositoryUrl?: string | undefined;
-    tagFormat?: string | undefined;
+    branches?: BranchSpec$1 | ReadonlyArray<BranchSpec$1>;
+    ci?: boolean;
+    dryRun?: boolean;
+    extends?: ReadonlyArray<string> | string;
+    plugins?: ReadonlyArray<PluginSpec>;
+    repositoryUrl?: string;
+    tagFormat?: string;
 }
 interface Commit {
     author: {
@@ -93,7 +93,7 @@ interface Release {
     gitHead?: string;
     gitTag?: string;
     name?: string;
-    type?: "build" | "major" | "minor" | "patch" | "premajor" | "preminor" | "prepatch" | "prerelease" | undefined;
+    type?: "build" | "major" | "minor" | "patch" | "premajor" | "preminor" | "prepatch" | "prerelease";
     version: string;
 }
 

package/dist/index.js

@@ -135,7 +135,7 @@ const addChannel$1 = async (pluginConfig, packageJson, context) => {
     const distributionTag = getChannel(channel);
     logger.log(`Adding version ${version} to npm registry on dist-tag ${distributionTag}`);
     const npmrc = getNpmrcPath(cwd, env);
-    const distTagArguments = ["dist-tag", "add", `${packageJson.name}@${version}`, distributionTag, "--registry", registry];
+    const distTagArguments = ["dist-tag", "add", `${packageJson.name ?? ""}@${version}`, distributionTag, "--registry", registry];
     debug$8(`Executing: pnpm ${distTagArguments.join(" ")}`);
     const result = execa("pnpm", distTagArguments, {
       cwd,
@@ -148,10 +148,10 @@ const addChannel$1 = async (pluginConfig, packageJson, context) => {
     result.stdout.pipe(stdout, { end: false });
     result.stderr.pipe(stderr, { end: false });
     await result;
-    logger.log(`Added ${packageJson.name}@${version} to dist-tag @${distributionTag} on ${registry}`);
+    logger.log(`Added ${packageJson.name ?? ""}@${version} to dist-tag @${distributionTag} on ${registry}`);
     return getReleaseInfo(packageJson, context, distributionTag, registry);
   }
-  logger.log(`Skip adding to npm channel as ${reasonToNotPublish(pluginConfig, packageJson)}`);
+  logger.log(`Skip adding to npm channel as ${reasonToNotPublish(pluginConfig, packageJson) ?? ""}`);
   return false;
 };
 
@@ -224,13 +224,14 @@ const publish$1 = async (pluginConfig, packageJson, context) => {
     try {
       await result;
     } catch (error) {
-      logger.log(`Failed to publish ${packageJson.name}@${version} to dist-tag @${distributionTag} on ${registry}: ${error.message ?? error}`);
-      throw new AggregateError([error], error.message);
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      logger.log(`Failed to publish ${packageJson.name ?? ""}@${version} to dist-tag @${distributionTag} on ${registry}: ${errorMessage}`);
+      throw new AggregateError([error], errorMessage, { cause: error });
     }
-    logger.log(`Published ${packageJson.name}@${version} to dist-tag @${distributionTag} on ${registry}`);
+    logger.log(`Published ${packageJson.name ?? ""}@${version} to dist-tag @${distributionTag} on ${registry}`);
     return getReleaseInfo(packageJson, context, distributionTag, registry);
   }
-  logger.log(`Skip publishing to npm registry as ${reasonToNotPublish(pluginConfig, packageJson)}`);
+  logger.log(`Skip publishing to npm registry as ${reasonToNotPublish(pluginConfig, packageJson) ?? ""}`);
   return false;
 };
 
@@ -308,7 +309,7 @@ Your configuration for the \`tarballDir\` option is \`${String(tarballDir)}\`.`,
       details: `When not publishing through [trusted publishing](https://docs.npmjs.com/trusted-publishers), an [npm token](${linkify(
         "README.md#npm-registry-authentication"
       )}) must be created and set in the \`NPM_TOKEN\` environment variable on your CI environment.
-Please make sure to create an [npm token](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens) and set it in the \`NPM_TOKEN\` environment variable on your CI environment. The token must allow publishing to the registry \`${registry}\`.`,
+Please make sure to create an [npm token](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens) and set it in the \`NPM_TOKEN\` environment variable on your CI environment. The token must allow publishing to the registry \`${registry ?? ""}\`.`,
       message: "No npm token specified."
     };
   },
@@ -356,7 +357,7 @@ const getPackage = async ({ pkgRoot }, { cwd }) => {
   } catch (error) {
     if (error.code === "ENOENT") {
       const semanticError = getError("ENOPKG");
-      throw new AggregateError([semanticError], semanticError.message);
+      throw new AggregateError([semanticError], semanticError.message, { cause: error });
     }
     throw error;
   }
@@ -373,10 +374,10 @@ const exchangeIdToken = async (idToken, packageName, context) => {
     debug$5("OIDC token exchange with the npm registry succeeded");
     return responseBody.token;
   }
-  debug$5(`OIDC token exchange with the npm registry failed: ${response.status} ${responseBody.message}`);
-  if (response.status === 404 || responseBody.message?.toLowerCase().includes("not found")) {
+  debug$5(`OIDC token exchange with the npm registry failed: ${String(response.status)} ${responseBody.message}`);
+  if (response.status === 404 || responseBody.message.toLowerCase().includes("not found")) {
     const warningMessage = `Package "${packageName}" does not exist on npm. npm requires a package to exist before you can configure OIDC trusted publishing. You can either publish a dummy version manually first (e.g., \`pnpm publish --tag dummy\`) or use the \`setup-npm-trusted-publish\` tool (https://github.com/azu/setup-npm-trusted-publish) to create a placeholder package. After the package exists, configure OIDC trusted publishing at https://www.npmjs.com/package/${encodeURIComponent(packageName)}/access`;
-    context?.logger?.error(warningMessage);
+    context?.logger.error(warningMessage);
     debug$5(warningMessage);
   }
   return void 0;
@@ -414,7 +415,7 @@ const tokenExchange = (pkg, context) => {
     return Promise.resolve(void 0);
   }
   const ciEnv = envCi();
-  const ciProviderName = typeof ciEnv === "object" && ciEnv !== null && typeof ciEnv.name === "string" ? ciEnv.name : void 0;
+  const ciProviderName = typeof ciEnv.name === "string" ? ciEnv.name : void 0;
   if (!ciProviderName) {
     debug$5("Unable to detect CI provider for OIDC token exchange");
     debug$5("Supported CI providers for OIDC trusted publishing: GitHub Actions, GitLab CI/CD");
@@ -523,7 +524,8 @@ const getCacheKey = (registry, context) => {
     });
     const token = getAuthToken(registry, { npmrc: config });
     if (token) {
-      const tokenId = token.length > 12 ? `${token.slice(0, 8)}...${token.slice(-4)}` : token.slice(0, 8);
+      const tokenValue = token.token;
+      const tokenId = tokenValue.length > 12 ? `${tokenValue.slice(0, 8)}...${tokenValue.slice(-4)}` : tokenValue.slice(0, 8);
       return `${normalizedRegistry}:token:${tokenId}`;
     }
   } catch {
@@ -532,8 +534,8 @@ const getCacheKey = (registry, context) => {
 };
 const isConnectionError = (error) => {
   const errorMessage = error instanceof Error ? error.message : String(error);
-  const errorCode = error?.code || "";
-  const isTimedOut = error?.timedOut === true;
+  const errorCode = error.code ?? "";
+  const isTimedOut = error.timedOut === true;
   return isTimedOut || errorCode === "ECONNREFUSED" || errorCode === "ETIMEDOUT" || errorMessage.includes("ECONNREFUSED") || errorMessage.includes("ETIMEDOUT") || errorMessage.includes("getaddrinfo ENOTFOUND") || errorMessage.includes("timed out");
 };
 const verifyAuthContextAgainstRegistry = async (npmrc, registry, context) => {
@@ -572,10 +574,10 @@ const verifyAuthContextAgainstRegistry = async (npmrc, registry, context) => {
     } catch (error) {
       if (isConnectionError(error)) {
         const semanticError2 = getError("EINVALIDNPMAUTH", { registry });
-        throw new AggregateError([semanticError2], semanticError2.message);
+        throw new AggregateError([semanticError2], semanticError2.message, { cause: error });
       }
       const semanticError = getError("EINVALIDNPMTOKEN", { registry });
-      throw new AggregateError([semanticError], semanticError.message);
+      throw new AggregateError([semanticError], semanticError.message, { cause: error });
     }
   })();
   whoamiCache.set(cacheKey, verificationPromise);
@@ -588,13 +590,15 @@ const verifyAuthContextAgainstRegistry = async (npmrc, registry, context) => {
     throw error;
   }
 };
-const isAuthErrorMessage = (message) => message.includes("requires you to be logged in") || message.includes("authentication") || message.includes("Unauthorized") || message.includes("401") || message.includes("403");
+const AUTH_STATUS_401 = /\b401\b/;
+const AUTH_STATUS_403 = /\b403\b/;
+const isAuthErrorMessage = (message) => message.includes("requires you to be logged in") || message.includes("authentication") || message.includes("Unauthorized") || AUTH_STATUS_401.test(message) || AUTH_STATUS_403.test(message);
 const handlePublishError = (error, registry) => {
   if (error instanceof AggregateError) {
     throw error;
   }
-  const errorStderrRaw = error?.stderr;
-  const errorStderr = Array.isArray(errorStderrRaw) ? errorStderrRaw.join("\n") : errorStderrRaw || "";
+  const errorStderrRaw = error.stderr;
+  const errorStderr = Array.isArray(errorStderrRaw) ? errorStderrRaw.join("\n") : errorStderrRaw ?? "";
   const errorMessage = error instanceof Error ? error.message : String(error);
   const combinedMessage = `${errorStderr} ${errorMessage}`;
   if (isConnectionError(error)) {
@@ -630,10 +634,6 @@ const verifyAuthContextAgainstCustomRegistry = async (npmrc, registry, context,
     }
     if (stderrString) {
       stderr.write(stderrString);
-      if (isAuthErrorMessage(stderrString)) {
-        const semanticError = getError("EINVALIDNPMAUTH", { registry });
-        throw new AggregateError([semanticError], semanticError.message);
-      }
     }
   } catch (error) {
     handlePublishError(error, registry);
@@ -705,27 +705,27 @@ const verifyConfig = (config) => (
 
 const debug$1 = dbg("semantic-release-pnpm:verify-pnpm");
 const MIN_PNPM_VERSION = "8.0.0";
-const verifyPnpm = async ({ logger }) => {
+const verifyPnpm = ({ logger }) => {
   logger.log(`Verify pnpm version is >= ${MIN_PNPM_VERSION}`);
   const version = getPackageManagerVersion("pnpm");
-  debug$1(`Detected pnpm version: ${String(version)}`);
+  debug$1(`Detected pnpm version: ${version}`);
   if (gte(MIN_PNPM_VERSION, version)) {
-    debug$1(`pnpm version ${String(version)} is below minimum required version ${MIN_PNPM_VERSION}`);
-    const semanticError = getError("EINVALIDPNPM", { version: String(version) });
+    debug$1(`pnpm version ${version} is below minimum required version ${MIN_PNPM_VERSION}`);
+    const semanticError = getError("EINVALIDPNPM", { version });
     throw new AggregateError([semanticError], semanticError.message);
   }
-  debug$1(`pnpm version ${String(version)} meets minimum requirement (>= ${MIN_PNPM_VERSION})`);
+  debug$1(`pnpm version ${version} meets minimum requirement (>= ${MIN_PNPM_VERSION})`);
 };
 
 const verify = async (pluginConfig, context) => {
   let errors = verifyConfig(pluginConfig);
   let errorsMessage = "";
   try {
-    await verifyPnpm(context);
+    verifyPnpm(context);
   } catch (error) {
     const typedError = error;
     errorsMessage += typedError.message;
-    errors = [...errors, ...typedError.errors ?? [error]];
+    errors = [...errors, ...typedError.errors];
   }
   try {
     const packageJson = await getPackage(pluginConfig, context);
@@ -739,7 +739,7 @@ const verify = async (pluginConfig, context) => {
   } catch (error) {
     const typedError = error;
     errorsMessage += typedError.message;
-    errors = [...errors, ...typedError.errors ?? [error]];
+    errors = [...errors, ...typedError.errors];
   }
   if (errors.length > 0) {
     throw new AggregateError(errors, errorsMessage);
@@ -753,7 +753,7 @@ let prepared;
 const verifyConditions = async (pluginConfig, context) => {
   if (context.options.publish) {
     const publish2 = Array.isArray(context.options.publish) ? context.options.publish : [context.options.publish];
-    const publishPlugin = publish2.find((config) => config.path && config.path === PLUGIN_NAME) || {};
+    const publishPlugin = publish2.find((config) => config.path && config.path === PLUGIN_NAME) ?? {};
     pluginConfig.npmPublish = pluginConfig.npmPublish ?? publishPlugin.npmPublish;
     pluginConfig.tarballDir = pluginConfig.tarballDir ?? publishPlugin.tarballDir;
     pluginConfig.pkgRoot = pluginConfig.pkgRoot ?? publishPlugin.pkgRoot;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anolilab/semantic-release-pnpm",
-  "version": "6.0.0",
+  "version": "8.0.0",
   "description": "Semantic-release plugin to publish a npm package with pnpm.",
   "keywords": [
     "anolilab",
@@ -61,7 +61,7 @@
   ],
   "dependencies": {
     "@actions/core": "3.0.0",
-    "@anolilab/rc": "4.0.0",
+    "@anolilab/rc": "4.0.1",
     "@semantic-release/error": "^4.0.0",
     "@visulima/fs": "^4.1.0",
     "@visulima/package": "^4.1.7",