@anolilab/semantic-release-pnpm 7.0.0 → 8.1.0

package/CHANGELOG.md

@@ -1,3 +1,26 @@
+## @anolilab/semantic-release-pnpm [8.1.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@8.0.0...@anolilab/semantic-release-pnpm@8.1.0) (2026-04-08)
+
+### Features
+
+* **semantic-release-pnpm:** add generic and CircleCI trusted publishing via NPM_ID_TOKEN ([c2aafd3](https://github.com/anolilab/semantic-release/commit/c2aafd301b45cdf5f92eef78ff0d461f7e0df0fb))
+
+### Bug Fixes
+
+* **semantic-release-pnpm:** allow tarballDir option to be set to false ([a31e1d6](https://github.com/anolilab/semantic-release/commit/a31e1d64b2e8481a73700a3dff64233e14aab91d)), closes [#302](https://github.com/anolilab/semantic-release/issues/302)
+
+## @anolilab/semantic-release-pnpm [8.0.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@7.0.0...@anolilab/semantic-release-pnpm@8.0.0) (2026-04-08)
+
+### Bug Fixes
+
+* **semantic-release-pnpm:** false EINVALIDNPMAUTH on successful dry-run publish ([ccb0475](https://github.com/anolilab/semantic-release/commit/ccb04758a6b3cf7176f5ea6a5081a0ec239c3e0e)), closes [anolilab/semantic-release#278](https://github.com/anolilab/semantic-release/issues/278)
+* **semantic-release-pnpm:** fix type errors and resolve all ESLint violations ([943e416](https://github.com/anolilab/semantic-release/commit/943e41694917a5a94c3d7f629acd198d7e37b592))
+* **semantic-release-pnpm:** fix verify-auth test and resolve ESLint violations ([9f38380](https://github.com/anolilab/semantic-release/commit/9f383802f58df3ceb13c46b570853c309ee95357))
+
+
+### Dependencies
+
+* **@anolilab/rc:** upgraded to 4.0.1
+
 ## @anolilab/semantic-release-pnpm [7.0.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@6.0.0...@anolilab/semantic-release-pnpm@7.0.0) (2026-04-07)
 
 ## @anolilab/semantic-release-pnpm [6.0.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@5.0.0...@anolilab/semantic-release-pnpm@6.0.0) (2026-04-07)

package/README.md

@@ -128,6 +128,28 @@ id_tokens:
 
 See the [npm documentation for more details about configuring pipeline details](https://docs.npmjs.com/trusted-publishers#gitlab-cicd-configuration)
 
+##### Trusted publishing for CircleCI
+
+To use trusted publishing in [CircleCI](https://docs.npmjs.com/trusted-publishers#circleci-configuration) you need to set the environment variable `NPM_ID_TOKEN` to an NPM Identity Token:
+
+```yaml
+jobs:
+    semantic-release:
+        steps:
+            # ...
+            - run:
+                  name: Semantic Release with Trusted Publishing via OIDC
+                  command: |
+                      # Fetch the OIDC token with the correct audience for npm
+                      export NPM_ID_TOKEN=$(circleci run oidc get --claims '{"aud": "npm:registry.npmjs.org"}')
+                      # Run semantic release
+                      npx semantic-release
+```
+
+##### Generic Trusted Publishing
+
+The generic mechanism for trusted publishing is to set the `NPM_ID_TOKEN` environment variable to an OIDC identity token. This approach works with any CI platform that has implemented trusted publishing support with npm but does not have specific built-in support in this plugin. If token exchange fails, it will fall back to using token authentication.
+
 ##### Unsupported CI providers
 
 Token authentication is **required** and can be set via [environment variables](#environment-variables).
@@ -158,9 +180,10 @@ Provenance applies specifically to publishing, so configure it under `publishCon
 
 ### Environment variables
 
-| Variable    | Description                                                                                                                   |
-| ----------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| `NPM_TOKEN` | Npm token created via [npm token create](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens) |
+| Variable       | Description                                                                                                                                                                                                                        |
+| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `NPM_TOKEN`    | Npm token created via [npm token create](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens)                                                                                                      |
+| `NPM_ID_TOKEN` | OIDC identity token for [trusted publishing](https://docs.npmjs.com/trusted-publishers). Must be configured in your CI job (see [GitLab](#trusted-publishing-for-gitlab-pipelines), [CircleCI](#trusted-publishing-for-circleci)). Takes priority over CI-specific token retrieval when set. |
 
 ### Options
 

package/dist/index.d.ts

@@ -1,22 +1,22 @@
 import stream from 'node:stream';
 
 interface BranchObject {
-    channel?: string | false | undefined;
+    channel?: string | false;
     name: string;
-    prerelease?: boolean | string | undefined;
-    range?: string | undefined;
+    prerelease?: boolean | string;
+    range?: string;
 }
 type BranchSpec$1 = BranchObject | string;
 type PluginSpec<T = any> = string | [string, T];
 interface Options {
     [name: string]: any;
-    branches?: BranchSpec$1 | ReadonlyArray<BranchSpec$1> | undefined;
-    ci?: boolean | undefined;
-    dryRun?: boolean | undefined;
-    extends?: ReadonlyArray<string> | string | undefined;
-    plugins?: ReadonlyArray<PluginSpec> | undefined;
-    repositoryUrl?: string | undefined;
-    tagFormat?: string | undefined;
+    branches?: BranchSpec$1 | ReadonlyArray<BranchSpec$1>;
+    ci?: boolean;
+    dryRun?: boolean;
+    extends?: ReadonlyArray<string> | string;
+    plugins?: ReadonlyArray<PluginSpec>;
+    repositoryUrl?: string;
+    tagFormat?: string;
 }
 interface Commit {
     author: {
@@ -93,7 +93,7 @@ interface Release {
     gitHead?: string;
     gitTag?: string;
     name?: string;
-    type?: "build" | "major" | "minor" | "patch" | "premajor" | "preminor" | "prepatch" | "prerelease" | undefined;
+    type?: "build" | "major" | "minor" | "patch" | "premajor" | "preminor" | "prepatch" | "prerelease";
     version: string;
 }
 
@@ -106,7 +106,7 @@ interface PluginConfig {
     npmPublish?: boolean;
     pkgRoot?: string;
     publishBranch?: string;
-    tarballDir?: string;
+    tarballDir?: false | string;
 }
 
 interface ReleaseInfo {

package/dist/index.js

@@ -58,7 +58,6 @@ const getNpmrcPath = (cwd, environment) => {
 
 const OFFICIAL_REGISTRY = "https://registry.npmjs.org/";
 const GITHUB_ACTIONS_PROVIDER_NAME = "GitHub Actions";
-const GITLAB_PIPELINES_PROVIDER_NAME = "GitLab CI/CD";
 
 const debug$9 = dbg("semantic-release-pnpm:registry");
 const getRegistryUrl = (scope, npmrc) => {
@@ -135,7 +134,7 @@ const addChannel$1 = async (pluginConfig, packageJson, context) => {
     const distributionTag = getChannel(channel);
     logger.log(`Adding version ${version} to npm registry on dist-tag ${distributionTag}`);
     const npmrc = getNpmrcPath(cwd, env);
-    const distTagArguments = ["dist-tag", "add", `${packageJson.name}@${version}`, distributionTag, "--registry", registry];
+    const distTagArguments = ["dist-tag", "add", `${packageJson.name ?? ""}@${version}`, distributionTag, "--registry", registry];
     debug$8(`Executing: pnpm ${distTagArguments.join(" ")}`);
     const result = execa("pnpm", distTagArguments, {
       cwd,
@@ -148,10 +147,10 @@ const addChannel$1 = async (pluginConfig, packageJson, context) => {
     result.stdout.pipe(stdout, { end: false });
     result.stderr.pipe(stderr, { end: false });
     await result;
-    logger.log(`Added ${packageJson.name}@${version} to dist-tag @${distributionTag} on ${registry}`);
+    logger.log(`Added ${packageJson.name ?? ""}@${version} to dist-tag @${distributionTag} on ${registry}`);
     return getReleaseInfo(packageJson, context, distributionTag, registry);
   }
-  logger.log(`Skip adding to npm channel as ${reasonToNotPublish(pluginConfig, packageJson)}`);
+  logger.log(`Skip adding to npm channel as ${reasonToNotPublish(pluginConfig, packageJson) ?? ""}`);
   return false;
 };
 
@@ -224,13 +223,14 @@ const publish$1 = async (pluginConfig, packageJson, context) => {
     try {
       await result;
     } catch (error) {
-      logger.log(`Failed to publish ${packageJson.name}@${version} to dist-tag @${distributionTag} on ${registry}: ${error.message ?? error}`);
-      throw new AggregateError([error], error.message);
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      logger.log(`Failed to publish ${packageJson.name ?? ""}@${version} to dist-tag @${distributionTag} on ${registry}: ${errorMessage}`);
+      throw new AggregateError([error], errorMessage, { cause: error });
     }
-    logger.log(`Published ${packageJson.name}@${version} to dist-tag @${distributionTag} on ${registry}`);
+    logger.log(`Published ${packageJson.name ?? ""}@${version} to dist-tag @${distributionTag} on ${registry}`);
     return getReleaseInfo(packageJson, context, distributionTag, registry);
   }
-  logger.log(`Skip publishing to npm registry as ${reasonToNotPublish(pluginConfig, packageJson)}`);
+  logger.log(`Skip publishing to npm registry as ${reasonToNotPublish(pluginConfig, packageJson) ?? ""}`);
   return false;
 };
 
@@ -298,7 +298,7 @@ Your configuration for the \`publishBranch\` option is \`${String(publishBranch)
   },
   EINVALIDTARBALLDIR: ({ tarballDir }) => {
     return {
-      details: `The [tarballDir option](${linkify("README.md#tarballdir")}) option, if defined, must be a \`String\`.
+      details: `The [tarballDir option](${linkify("README.md#tarballdir")}) option, if defined, must be a \`String\` or \`false\`.
 Your configuration for the \`tarballDir\` option is \`${String(tarballDir)}\`.`,
       message: "Invalid `tarballDir` option."
     };
@@ -308,7 +308,7 @@ Your configuration for the \`tarballDir\` option is \`${String(tarballDir)}\`.`,
       details: `When not publishing through [trusted publishing](https://docs.npmjs.com/trusted-publishers), an [npm token](${linkify(
         "README.md#npm-registry-authentication"
       )}) must be created and set in the \`NPM_TOKEN\` environment variable on your CI environment.
-Please make sure to create an [npm token](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens) and set it in the \`NPM_TOKEN\` environment variable on your CI environment. The token must allow publishing to the registry \`${registry}\`.`,
+Please make sure to create an [npm token](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens) and set it in the \`NPM_TOKEN\` environment variable on your CI environment. The token must allow publishing to the registry \`${registry ?? ""}\`.`,
       message: "No npm token specified."
     };
   },
@@ -356,7 +356,7 @@ const getPackage = async ({ pkgRoot }, { cwd }) => {
   } catch (error) {
     if (error.code === "ENOENT") {
       const semanticError = getError("ENOPKG");
-      throw new AggregateError([semanticError], semanticError.message);
+      throw new AggregateError([semanticError], semanticError.message, { cause: error });
     }
     throw error;
   }
@@ -373,10 +373,10 @@ const exchangeIdToken = async (idToken, packageName, context) => {
     debug$5("OIDC token exchange with the npm registry succeeded");
     return responseBody.token;
   }
-  debug$5(`OIDC token exchange with the npm registry failed: ${response.status} ${responseBody.message}`);
-  if (response.status === 404 || responseBody.message?.toLowerCase().includes("not found")) {
+  debug$5(`OIDC token exchange with the npm registry failed: ${String(response.status)} ${responseBody.message}`);
+  if (response.status === 404 || responseBody.message.toLowerCase().includes("not found")) {
     const warningMessage = `Package "${packageName}" does not exist on npm. npm requires a package to exist before you can configure OIDC trusted publishing. You can either publish a dummy version manually first (e.g., \`pnpm publish --tag dummy\`) or use the \`setup-npm-trusted-publish\` tool (https://github.com/azu/setup-npm-trusted-publish) to create a placeholder package. After the package exists, configure OIDC trusted publishing at https://www.npmjs.com/package/${encodeURIComponent(packageName)}/access`;
-    context?.logger?.error(warningMessage);
+    context?.logger.error(warningMessage);
     debug$5(warningMessage);
   }
   return void 0;
@@ -398,37 +398,27 @@ const exchangeGithubActionsToken = async (packageName, context) => {
   }
   return exchangeIdToken(idToken, packageName, context);
 };
-const exchangeGitlabPipelinesToken = async (packageName, context) => {
-  const idToken = process.env.NPM_ID_TOKEN;
-  debug$5("Verifying OIDC context for publishing from GitLab Pipelines");
-  if (!idToken) {
-    debug$5("NPM_ID_TOKEN environment variable is not set");
-    debug$5("Configure trusted publishing in your GitLab project settings and set the NPM_ID_TOKEN variable");
-    return void 0;
-  }
-  return exchangeIdToken(idToken, packageName, context);
-};
 const tokenExchange = (pkg, context) => {
   if (!pkg.name || typeof pkg.name !== "string" || pkg.name.trim() === "") {
     context.logger.error("Invalid package name provided for OIDC token exchange");
     return Promise.resolve(void 0);
   }
+  const idToken = process.env.NPM_ID_TOKEN;
+  if (idToken) {
+    debug$5("NPM_ID_TOKEN environment variable detected, using it for OIDC token exchange");
+    return exchangeIdToken(idToken, pkg.name, context);
+  }
   const ciEnv = envCi();
-  const ciProviderName = typeof ciEnv === "object" && ciEnv !== null && typeof ciEnv.name === "string" ? ciEnv.name : void 0;
+  const ciProviderName = typeof ciEnv.name === "string" ? ciEnv.name : void 0;
   if (!ciProviderName) {
     debug$5("Unable to detect CI provider for OIDC token exchange");
-    debug$5("Supported CI providers for OIDC trusted publishing: GitHub Actions, GitLab CI/CD");
     return Promise.resolve(void 0);
   }
   debug$5(`Detected CI provider: ${ciProviderName}`);
   if (GITHUB_ACTIONS_PROVIDER_NAME === ciProviderName) {
     return exchangeGithubActionsToken(pkg.name, context);
   }
-  if (GITLAB_PIPELINES_PROVIDER_NAME === ciProviderName) {
-    return exchangeGitlabPipelinesToken(pkg.name, context);
-  }
-  debug$5(`CI provider "${ciProviderName}" is not supported for OIDC trusted publishing`);
-  debug$5("Supported CI providers: GitHub Actions, GitLab CI/CD");
+  debug$5(`CI provider "${ciProviderName}" does not have built-in OIDC support; set NPM_ID_TOKEN to use trusted publishing`);
   return Promise.resolve(void 0);
 };
 
@@ -523,7 +513,8 @@ const getCacheKey = (registry, context) => {
     });
     const token = getAuthToken(registry, { npmrc: config });
     if (token) {
-      const tokenId = token.length > 12 ? `${token.slice(0, 8)}...${token.slice(-4)}` : token.slice(0, 8);
+      const tokenValue = token.token;
+      const tokenId = tokenValue.length > 12 ? `${tokenValue.slice(0, 8)}...${tokenValue.slice(-4)}` : tokenValue.slice(0, 8);
       return `${normalizedRegistry}:token:${tokenId}`;
     }
   } catch {
@@ -532,8 +523,8 @@ const getCacheKey = (registry, context) => {
 };
 const isConnectionError = (error) => {
   const errorMessage = error instanceof Error ? error.message : String(error);
-  const errorCode = error?.code || "";
-  const isTimedOut = error?.timedOut === true;
+  const errorCode = error.code ?? "";
+  const isTimedOut = error.timedOut === true;
   return isTimedOut || errorCode === "ECONNREFUSED" || errorCode === "ETIMEDOUT" || errorMessage.includes("ECONNREFUSED") || errorMessage.includes("ETIMEDOUT") || errorMessage.includes("getaddrinfo ENOTFOUND") || errorMessage.includes("timed out");
 };
 const verifyAuthContextAgainstRegistry = async (npmrc, registry, context) => {
@@ -572,10 +563,10 @@ const verifyAuthContextAgainstRegistry = async (npmrc, registry, context) => {
     } catch (error) {
       if (isConnectionError(error)) {
         const semanticError2 = getError("EINVALIDNPMAUTH", { registry });
-        throw new AggregateError([semanticError2], semanticError2.message);
+        throw new AggregateError([semanticError2], semanticError2.message, { cause: error });
       }
       const semanticError = getError("EINVALIDNPMTOKEN", { registry });
-      throw new AggregateError([semanticError], semanticError.message);
+      throw new AggregateError([semanticError], semanticError.message, { cause: error });
     }
   })();
   whoamiCache.set(cacheKey, verificationPromise);
@@ -588,13 +579,15 @@ const verifyAuthContextAgainstRegistry = async (npmrc, registry, context) => {
     throw error;
   }
 };
-const isAuthErrorMessage = (message) => message.includes("requires you to be logged in") || message.includes("authentication") || message.includes("Unauthorized") || message.includes("401") || message.includes("403");
+const AUTH_STATUS_401 = /\b401\b/;
+const AUTH_STATUS_403 = /\b403\b/;
+const isAuthErrorMessage = (message) => message.includes("requires you to be logged in") || message.includes("authentication") || message.includes("Unauthorized") || AUTH_STATUS_401.test(message) || AUTH_STATUS_403.test(message);
 const handlePublishError = (error, registry) => {
   if (error instanceof AggregateError) {
     throw error;
   }
-  const errorStderrRaw = error?.stderr;
-  const errorStderr = Array.isArray(errorStderrRaw) ? errorStderrRaw.join("\n") : errorStderrRaw || "";
+  const errorStderrRaw = error.stderr;
+  const errorStderr = Array.isArray(errorStderrRaw) ? errorStderrRaw.join("\n") : errorStderrRaw ?? "";
   const errorMessage = error instanceof Error ? error.message : String(error);
   const combinedMessage = `${errorStderr} ${errorMessage}`;
   if (isConnectionError(error)) {
@@ -630,10 +623,6 @@ const verifyAuthContextAgainstCustomRegistry = async (npmrc, registry, context,
     }
     if (stderrString) {
       stderr.write(stderrString);
-      if (isAuthErrorMessage(stderrString)) {
-        const semanticError = getError("EINVALIDNPMAUTH", { registry });
-        throw new AggregateError([semanticError], semanticError.message);
-      }
     }
   } catch (error) {
     handlePublishError(error, registry);
@@ -685,7 +674,8 @@ const VALIDATORS = {
   npmPublish: (value) => typeof value === "boolean",
   pkgRoot: isNonEmptyString,
   publishBranch: isNonEmptyString,
-  tarballDir: isNonEmptyString
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  tarballDir: (value) => value === false || isNonEmptyString(value)
 };
 const verifyConfig = (config) => (
   // eslint-disable-next-line unicorn/no-array-reduce
@@ -705,27 +695,27 @@ const verifyConfig = (config) => (
 
 const debug$1 = dbg("semantic-release-pnpm:verify-pnpm");
 const MIN_PNPM_VERSION = "8.0.0";
-const verifyPnpm = async ({ logger }) => {
+const verifyPnpm = ({ logger }) => {
   logger.log(`Verify pnpm version is >= ${MIN_PNPM_VERSION}`);
   const version = getPackageManagerVersion("pnpm");
-  debug$1(`Detected pnpm version: ${String(version)}`);
+  debug$1(`Detected pnpm version: ${version}`);
   if (gte(MIN_PNPM_VERSION, version)) {
-    debug$1(`pnpm version ${String(version)} is below minimum required version ${MIN_PNPM_VERSION}`);
-    const semanticError = getError("EINVALIDPNPM", { version: String(version) });
+    debug$1(`pnpm version ${version} is below minimum required version ${MIN_PNPM_VERSION}`);
+    const semanticError = getError("EINVALIDPNPM", { version });
     throw new AggregateError([semanticError], semanticError.message);
   }
-  debug$1(`pnpm version ${String(version)} meets minimum requirement (>= ${MIN_PNPM_VERSION})`);
+  debug$1(`pnpm version ${version} meets minimum requirement (>= ${MIN_PNPM_VERSION})`);
 };
 
 const verify = async (pluginConfig, context) => {
   let errors = verifyConfig(pluginConfig);
   let errorsMessage = "";
   try {
-    await verifyPnpm(context);
+    verifyPnpm(context);
   } catch (error) {
     const typedError = error;
     errorsMessage += typedError.message;
-    errors = [...errors, ...typedError.errors ?? [error]];
+    errors = [...errors, ...typedError.errors];
   }
   try {
     const packageJson = await getPackage(pluginConfig, context);
@@ -739,7 +729,7 @@ const verify = async (pluginConfig, context) => {
   } catch (error) {
     const typedError = error;
     errorsMessage += typedError.message;
-    errors = [...errors, ...typedError.errors ?? [error]];
+    errors = [...errors, ...typedError.errors];
   }
   if (errors.length > 0) {
     throw new AggregateError(errors, errorsMessage);
@@ -753,7 +743,7 @@ let prepared;
 const verifyConditions = async (pluginConfig, context) => {
   if (context.options.publish) {
     const publish2 = Array.isArray(context.options.publish) ? context.options.publish : [context.options.publish];
-    const publishPlugin = publish2.find((config) => config.path && config.path === PLUGIN_NAME) || {};
+    const publishPlugin = publish2.find((config) => config.path && config.path === PLUGIN_NAME) ?? {};
     pluginConfig.npmPublish = pluginConfig.npmPublish ?? publishPlugin.npmPublish;
     pluginConfig.tarballDir = pluginConfig.tarballDir ?? publishPlugin.tarballDir;
     pluginConfig.pkgRoot = pluginConfig.pkgRoot ?? publishPlugin.pkgRoot;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anolilab/semantic-release-pnpm",
-  "version": "7.0.0",
+  "version": "8.1.0",
   "description": "Semantic-release plugin to publish a npm package with pnpm.",
   "keywords": [
     "anolilab",
@@ -61,7 +61,7 @@
   ],
   "dependencies": {
     "@actions/core": "3.0.0",
-    "@anolilab/rc": "4.0.0",
+    "@anolilab/rc": "4.0.1",
     "@semantic-release/error": "^4.0.0",
     "@visulima/fs": "^4.1.0",
     "@visulima/package": "^4.1.7",