@anolilab/semantic-release-pnpm 8.0.0 → 8.1.1

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## @anolilab/semantic-release-pnpm [8.1.1](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@8.1.0...@anolilab/semantic-release-pnpm@8.1.1) (2026-04-15)
+
+### Bug Fixes
+
+* **semantic-release-pnpm:** support pnpm v10 in prepare step ([f1dee76](https://github.com/anolilab/semantic-release/commit/f1dee765dc2278cecde34e85bc6d7096eeeba3d5))
+
+## @anolilab/semantic-release-pnpm [8.1.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@8.0.0...@anolilab/semantic-release-pnpm@8.1.0) (2026-04-08)
+
+### Features
+
+* **semantic-release-pnpm:** add generic and CircleCI trusted publishing via NPM_ID_TOKEN ([c2aafd3](https://github.com/anolilab/semantic-release/commit/c2aafd301b45cdf5f92eef78ff0d461f7e0df0fb))
+
+### Bug Fixes
+
+* **semantic-release-pnpm:** allow tarballDir option to be set to false ([a31e1d6](https://github.com/anolilab/semantic-release/commit/a31e1d64b2e8481a73700a3dff64233e14aab91d)), closes [#302](https://github.com/anolilab/semantic-release/issues/302)
+
 ## @anolilab/semantic-release-pnpm [8.0.0](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@7.0.0...@anolilab/semantic-release-pnpm@8.0.0) (2026-04-08)
 
 ### Bug Fixes

package/README.md

@@ -128,6 +128,28 @@ id_tokens:
 
 See the [npm documentation for more details about configuring pipeline details](https://docs.npmjs.com/trusted-publishers#gitlab-cicd-configuration)
 
+##### Trusted publishing for CircleCI
+
+To use trusted publishing in [CircleCI](https://docs.npmjs.com/trusted-publishers#circleci-configuration) you need to set the environment variable `NPM_ID_TOKEN` to an NPM Identity Token:
+
+```yaml
+jobs:
+    semantic-release:
+        steps:
+            # ...
+            - run:
+                  name: Semantic Release with Trusted Publishing via OIDC
+                  command: |
+                      # Fetch the OIDC token with the correct audience for npm
+                      export NPM_ID_TOKEN=$(circleci run oidc get --claims '{"aud": "npm:registry.npmjs.org"}')
+                      # Run semantic release
+                      npx semantic-release
+```
+
+##### Generic Trusted Publishing
+
+The generic mechanism for trusted publishing is to set the `NPM_ID_TOKEN` environment variable to an OIDC identity token. This approach works with any CI platform that has implemented trusted publishing support with npm but does not have specific built-in support in this plugin. If token exchange fails, it will fall back to using token authentication.
+
 ##### Unsupported CI providers
 
 Token authentication is **required** and can be set via [environment variables](#environment-variables).
@@ -158,9 +180,10 @@ Provenance applies specifically to publishing, so configure it under `publishCon
 
 ### Environment variables
 
-| Variable    | Description                                                                                                                   |
-| ----------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| `NPM_TOKEN` | Npm token created via [npm token create](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens) |
+| Variable       | Description                                                                                                                                                                                                                                                                                  |
+| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `NPM_TOKEN`    | Npm token created via [npm token create](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens)                                                                                                                                                                |
+| `NPM_ID_TOKEN` | OIDC identity token for [trusted publishing](https://docs.npmjs.com/trusted-publishers). Must be configured in your CI job (see [GitLab](#trusted-publishing-for-gitlab-pipelines), [CircleCI](#trusted-publishing-for-circleci)). Takes priority over CI-specific token retrieval when set. |
 
 ### Options
 

package/dist/index.d.ts

@@ -106,7 +106,7 @@ interface PluginConfig {
     npmPublish?: boolean;
     pkgRoot?: string;
     publishBranch?: string;
-    tarballDir?: string;
+    tarballDir?: false | string;
 }
 
 interface ReleaseInfo {

package/dist/index.js

@@ -19,12 +19,12 @@ const __cjs_getBuiltinModule = (module) => {
 
 import dbg from 'debug';
 import { execa } from 'execa';
-import { validRange, gte } from 'semver';
-import { isAccessibleSync, ensureFileSync, move, writeFile } from '@visulima/fs';
+import { validRange, major, gte } from 'semver';
+import { isAccessibleSync, ensureFileSync, isAccessible, readJson, writeJson, move, writeFile } from '@visulima/fs';
 import { resolve } from '@visulima/path';
 import { rc } from '@anolilab/rc';
 import normalizeUrl from 'normalize-url';
-import { findPackageJson, getPackageManagerVersion } from '@visulima/package';
+import { getPackageManagerVersion, findPackageJson } from '@visulima/package';
 import SemanticReleaseError from '@semantic-release/error';
 import { stringify } from 'ini';
 import getAuthToken from 'registry-auth-token';
@@ -58,7 +58,6 @@ const getNpmrcPath = (cwd, environment) => {
 
 const OFFICIAL_REGISTRY = "https://registry.npmjs.org/";
 const GITHUB_ACTIONS_PROVIDER_NAME = "GitHub Actions";
-const GITLAB_PIPELINES_PROVIDER_NAME = "GitLab CI/CD";
 
 const debug$9 = dbg("semantic-release-pnpm:registry");
 const getRegistryUrl = (scope, npmrc) => {
@@ -159,7 +158,11 @@ const debug$7 = dbg("semantic-release-pnpm:prepare");
 const prepare$1 = async ({ pkgRoot, tarballDir }, { cwd, env, logger, nextRelease: { version }, stderr, stdout }) => {
   const basePath = pkgRoot ? resolve(cwd, pkgRoot) : cwd;
   logger.log("Write version %s to package.json in %s", version, basePath);
-  const versionResult = execa("pnpm", ["version", version, "--no-git-tag-version", "--allow-same-version"], {
+  const pnpmVersion = getPackageManagerVersion("pnpm");
+  const pnpmMajor = major(pnpmVersion);
+  debug$7("Detected pnpm major version: %d", pnpmMajor);
+  const versionArguments = pnpmMajor >= 10 ? ["pkg", "set", `version=${version}`] : ["version", version, "--no-git-tag-version", "--allow-same-version"];
+  const versionResult = execa("pnpm", versionArguments, {
     cwd: basePath,
     env,
     preferLocal: true
@@ -167,6 +170,15 @@ const prepare$1 = async ({ pkgRoot, tarballDir }, { cwd, env, logger, nextReleas
   versionResult.stdout.pipe(stdout, { end: false });
   versionResult.stderr.pipe(stderr, { end: false });
   await versionResult;
+  if (pnpmMajor >= 10) {
+    const shrinkwrapPath = resolve(basePath, "npm-shrinkwrap.json");
+    if (await isAccessible(shrinkwrapPath)) {
+      debug$7(`Updating npm-shrinkwrap.json at ${shrinkwrapPath}`);
+      const shrinkwrap = await readJson(shrinkwrapPath);
+      shrinkwrap.version = version;
+      await writeJson(shrinkwrapPath, shrinkwrap, { indent: 2 });
+    }
+  }
   if (tarballDir) {
     logger.log("Creating npm package version %s", version);
     const packResult = execa("pnpm", ["pack", basePath], { cwd, env, preferLocal: true });
@@ -299,7 +311,7 @@ Your configuration for the \`publishBranch\` option is \`${String(publishBranch)
   },
   EINVALIDTARBALLDIR: ({ tarballDir }) => {
     return {
-      details: `The [tarballDir option](${linkify("README.md#tarballdir")}) option, if defined, must be a \`String\`.
+      details: `The [tarballDir option](${linkify("README.md#tarballdir")}) option, if defined, must be a \`String\` or \`false\`.
 Your configuration for the \`tarballDir\` option is \`${String(tarballDir)}\`.`,
       message: "Invalid `tarballDir` option."
     };
@@ -399,37 +411,27 @@ const exchangeGithubActionsToken = async (packageName, context) => {
   }
   return exchangeIdToken(idToken, packageName, context);
 };
-const exchangeGitlabPipelinesToken = async (packageName, context) => {
-  const idToken = process.env.NPM_ID_TOKEN;
-  debug$5("Verifying OIDC context for publishing from GitLab Pipelines");
-  if (!idToken) {
-    debug$5("NPM_ID_TOKEN environment variable is not set");
-    debug$5("Configure trusted publishing in your GitLab project settings and set the NPM_ID_TOKEN variable");
-    return void 0;
-  }
-  return exchangeIdToken(idToken, packageName, context);
-};
 const tokenExchange = (pkg, context) => {
   if (!pkg.name || typeof pkg.name !== "string" || pkg.name.trim() === "") {
     context.logger.error("Invalid package name provided for OIDC token exchange");
     return Promise.resolve(void 0);
   }
+  const idToken = process.env.NPM_ID_TOKEN;
+  if (idToken) {
+    debug$5("NPM_ID_TOKEN environment variable detected, using it for OIDC token exchange");
+    return exchangeIdToken(idToken, pkg.name, context);
+  }
   const ciEnv = envCi();
   const ciProviderName = typeof ciEnv.name === "string" ? ciEnv.name : void 0;
   if (!ciProviderName) {
     debug$5("Unable to detect CI provider for OIDC token exchange");
-    debug$5("Supported CI providers for OIDC trusted publishing: GitHub Actions, GitLab CI/CD");
     return Promise.resolve(void 0);
   }
   debug$5(`Detected CI provider: ${ciProviderName}`);
   if (GITHUB_ACTIONS_PROVIDER_NAME === ciProviderName) {
     return exchangeGithubActionsToken(pkg.name, context);
   }
-  if (GITLAB_PIPELINES_PROVIDER_NAME === ciProviderName) {
-    return exchangeGitlabPipelinesToken(pkg.name, context);
-  }
-  debug$5(`CI provider "${ciProviderName}" is not supported for OIDC trusted publishing`);
-  debug$5("Supported CI providers: GitHub Actions, GitLab CI/CD");
+  debug$5(`CI provider "${ciProviderName}" does not have built-in OIDC support; set NPM_ID_TOKEN to use trusted publishing`);
   return Promise.resolve(void 0);
 };
 
@@ -685,7 +687,8 @@ const VALIDATORS = {
   npmPublish: (value) => typeof value === "boolean",
   pkgRoot: isNonEmptyString,
   publishBranch: isNonEmptyString,
-  tarballDir: isNonEmptyString
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  tarballDir: (value) => value === false || isNonEmptyString(value)
 };
 const verifyConfig = (config) => (
   // eslint-disable-next-line unicorn/no-array-reduce

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anolilab/semantic-release-pnpm",
-  "version": "8.0.0",
+  "version": "8.1.1",
   "description": "Semantic-release plugin to publish a npm package with pnpm.",
   "keywords": [
     "anolilab",