@anolilab/semantic-release-pnpm 8.0.0 → 8.1.0

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## @anolilab/semantic-release-pnpm [8.1.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@8.0.0...@anolilab/semantic-release-pnpm@8.1.0) (2026-04-08)
+
+### Features
+
+* **semantic-release-pnpm:** add generic and CircleCI trusted publishing via NPM_ID_TOKEN ([c2aafd3](https://github.com/anolilab/semantic-release/commit/c2aafd301b45cdf5f92eef78ff0d461f7e0df0fb))
+
+### Bug Fixes
+
+* **semantic-release-pnpm:** allow tarballDir option to be set to false ([a31e1d6](https://github.com/anolilab/semantic-release/commit/a31e1d64b2e8481a73700a3dff64233e14aab91d)), closes [#302](https://github.com/anolilab/semantic-release/issues/302)
+
 ## @anolilab/semantic-release-pnpm [8.0.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@7.0.0...@anolilab/semantic-release-pnpm@8.0.0) (2026-04-08)
 
 ### Bug Fixes

package/README.md

@@ -128,6 +128,28 @@ id_tokens:
 
 See the [npm documentation for more details about configuring pipeline details](https://docs.npmjs.com/trusted-publishers#gitlab-cicd-configuration)
 
+##### Trusted publishing for CircleCI
+
+To use trusted publishing in [CircleCI](https://docs.npmjs.com/trusted-publishers#circleci-configuration) you need to set the environment variable `NPM_ID_TOKEN` to an NPM Identity Token:
+
+```yaml
+jobs:
+    semantic-release:
+        steps:
+            # ...
+            - run:
+                  name: Semantic Release with Trusted Publishing via OIDC
+                  command: |
+                      # Fetch the OIDC token with the correct audience for npm
+                      export NPM_ID_TOKEN=$(circleci run oidc get --claims '{"aud": "npm:registry.npmjs.org"}')
+                      # Run semantic release
+                      npx semantic-release
+```
+
+##### Generic Trusted Publishing
+
+The generic mechanism for trusted publishing is to set the `NPM_ID_TOKEN` environment variable to an OIDC identity token. This approach works with any CI platform that has implemented trusted publishing support with npm but does not have specific built-in support in this plugin. If token exchange fails, it will fall back to using token authentication.
+
 ##### Unsupported CI providers
 
 Token authentication is **required** and can be set via [environment variables](#environment-variables).
@@ -158,9 +180,10 @@ Provenance applies specifically to publishing, so configure it under `publishCon
 
 ### Environment variables
 
-| Variable    | Description                                                                                                                   |
-| ----------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| `NPM_TOKEN` | Npm token created via [npm token create](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens) |
+| Variable       | Description                                                                                                                                                                                                                        |
+| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `NPM_TOKEN`    | Npm token created via [npm token create](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens)                                                                                                      |
+| `NPM_ID_TOKEN` | OIDC identity token for [trusted publishing](https://docs.npmjs.com/trusted-publishers). Must be configured in your CI job (see [GitLab](#trusted-publishing-for-gitlab-pipelines), [CircleCI](#trusted-publishing-for-circleci)). Takes priority over CI-specific token retrieval when set. |
 
 ### Options
 

package/dist/index.d.ts

@@ -106,7 +106,7 @@ interface PluginConfig {
     npmPublish?: boolean;
     pkgRoot?: string;
     publishBranch?: string;
-    tarballDir?: string;
+    tarballDir?: false | string;
 }
 
 interface ReleaseInfo {

package/dist/index.js

@@ -58,7 +58,6 @@ const getNpmrcPath = (cwd, environment) => {
 
 const OFFICIAL_REGISTRY = "https://registry.npmjs.org/";
 const GITHUB_ACTIONS_PROVIDER_NAME = "GitHub Actions";
-const GITLAB_PIPELINES_PROVIDER_NAME = "GitLab CI/CD";
 
 const debug$9 = dbg("semantic-release-pnpm:registry");
 const getRegistryUrl = (scope, npmrc) => {
@@ -299,7 +298,7 @@ Your configuration for the \`publishBranch\` option is \`${String(publishBranch)
   },
   EINVALIDTARBALLDIR: ({ tarballDir }) => {
     return {
-      details: `The [tarballDir option](${linkify("README.md#tarballdir")}) option, if defined, must be a \`String\`.
+      details: `The [tarballDir option](${linkify("README.md#tarballdir")}) option, if defined, must be a \`String\` or \`false\`.
 Your configuration for the \`tarballDir\` option is \`${String(tarballDir)}\`.`,
       message: "Invalid `tarballDir` option."
     };
@@ -399,37 +398,27 @@ const exchangeGithubActionsToken = async (packageName, context) => {
   }
   return exchangeIdToken(idToken, packageName, context);
 };
-const exchangeGitlabPipelinesToken = async (packageName, context) => {
-  const idToken = process.env.NPM_ID_TOKEN;
-  debug$5("Verifying OIDC context for publishing from GitLab Pipelines");
-  if (!idToken) {
-    debug$5("NPM_ID_TOKEN environment variable is not set");
-    debug$5("Configure trusted publishing in your GitLab project settings and set the NPM_ID_TOKEN variable");
-    return void 0;
-  }
-  return exchangeIdToken(idToken, packageName, context);
-};
 const tokenExchange = (pkg, context) => {
   if (!pkg.name || typeof pkg.name !== "string" || pkg.name.trim() === "") {
     context.logger.error("Invalid package name provided for OIDC token exchange");
     return Promise.resolve(void 0);
   }
+  const idToken = process.env.NPM_ID_TOKEN;
+  if (idToken) {
+    debug$5("NPM_ID_TOKEN environment variable detected, using it for OIDC token exchange");
+    return exchangeIdToken(idToken, pkg.name, context);
+  }
   const ciEnv = envCi();
   const ciProviderName = typeof ciEnv.name === "string" ? ciEnv.name : void 0;
   if (!ciProviderName) {
     debug$5("Unable to detect CI provider for OIDC token exchange");
-    debug$5("Supported CI providers for OIDC trusted publishing: GitHub Actions, GitLab CI/CD");
     return Promise.resolve(void 0);
   }
   debug$5(`Detected CI provider: ${ciProviderName}`);
   if (GITHUB_ACTIONS_PROVIDER_NAME === ciProviderName) {
     return exchangeGithubActionsToken(pkg.name, context);
   }
-  if (GITLAB_PIPELINES_PROVIDER_NAME === ciProviderName) {
-    return exchangeGitlabPipelinesToken(pkg.name, context);
-  }
-  debug$5(`CI provider "${ciProviderName}" is not supported for OIDC trusted publishing`);
-  debug$5("Supported CI providers: GitHub Actions, GitLab CI/CD");
+  debug$5(`CI provider "${ciProviderName}" does not have built-in OIDC support; set NPM_ID_TOKEN to use trusted publishing`);
   return Promise.resolve(void 0);
 };
 
@@ -685,7 +674,8 @@ const VALIDATORS = {
   npmPublish: (value) => typeof value === "boolean",
   pkgRoot: isNonEmptyString,
   publishBranch: isNonEmptyString,
-  tarballDir: isNonEmptyString
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  tarballDir: (value) => value === false || isNonEmptyString(value)
 };
 const verifyConfig = (config) => (
   // eslint-disable-next-line unicorn/no-array-reduce

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anolilab/semantic-release-pnpm",
-  "version": "8.0.0",
+  "version": "8.1.0",
   "description": "Semantic-release plugin to publish a npm package with pnpm.",
   "keywords": [
     "anolilab",