@anolilab/semantic-release-pnpm 8.1.4 → 8.1.6

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## @anolilab/semantic-release-pnpm [8.1.6](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@8.1.5...@anolilab/semantic-release-pnpm@8.1.6) (2026-04-28)
+
+## @anolilab/semantic-release-pnpm [8.1.5](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@8.1.4...@anolilab/semantic-release-pnpm@8.1.5) (2026-04-27)
+
+### Bug Fixes
+
+* **semantic-release-pnpm:** align integration test with whoami error and add cache reset helper ([fdfc677](https://github.com/anolilab/semantic-release/commit/fdfc67705d1ba0b28dee9acd9b61fc1ec6916e62))
+* **semantic-release-pnpm:** remove duplicate verifyAuthContextAgainstCustomRegistry function ([dc64c44](https://github.com/anolilab/semantic-release/commit/dc64c4443e61883136d78fb407ba1329bc06fc09))
+* **semantic-release-pnpm:** use `npm pkg set` on pnpm v10+ ([c96d683](https://github.com/anolilab/semantic-release/commit/c96d6834099a2cfafa000a976be73fa9074f531c))
+* **semantic-release-pnpm:** use pnpm whoami for custom registry auth verification ([afee204](https://github.com/anolilab/semantic-release/commit/afee2047abcd6201d63414f80349a7e5331925f8))
+
+### Tests
+
+* **semantic-release-pnpm:** strengthen already-published regression test ([6e84c11](https://github.com/anolilab/semantic-release/commit/6e84c11505925e47bc72aff1e1d2fa897125e276))
+* **semantic-release-pnpm:** use distinct registry URL in whoami-failure test to avoid cache collision ([5900697](https://github.com/anolilab/semantic-release/commit/59006976fb6aec218b85e7d54fcff3332f3dee19))
+
 ## @anolilab/semantic-release-pnpm [8.1.4](https://github.com/anolilab/semantic-release/compare/@anolilab/semantic-release-pnpm@8.1.3...@anolilab/semantic-release-pnpm@8.1.4) (2026-04-26)
 
 ### Miscellaneous Chores

package/dist/index.js

@@ -161,8 +161,9 @@ const prepare$1 = async ({ pkgRoot, tarballDir }, { cwd, env, logger, nextReleas
   const pnpmVersion = getPackageManagerVersion("pnpm");
   const pnpmMajor = major(pnpmVersion);
   debug$7("Detected pnpm major version: %d", pnpmMajor);
+  const versionBin = pnpmMajor >= 10 ? "npm" : "pnpm";
   const versionArguments = pnpmMajor >= 10 ? ["pkg", "set", `version=${version}`] : ["version", version, "--no-git-tag-version", "--allow-same-version"];
-  const versionResult = execa("pnpm", versionArguments, {
+  const versionResult = execa(versionBin, versionArguments, {
     cwd: basePath,
     env,
     preferLocal: true
@@ -592,56 +593,7 @@ const verifyAuthContextAgainstRegistry = async (npmrc, registry, context) => {
     throw error;
   }
 };
-const AUTH_STATUS_401 = /\b401\b/;
-const AUTH_STATUS_403 = /\b403\b/;
-const isAuthErrorMessage = (message) => message.includes("requires you to be logged in") || message.includes("authentication") || message.includes("Unauthorized") || AUTH_STATUS_401.test(message) || AUTH_STATUS_403.test(message);
-const handlePublishError = (error, registry) => {
-  if (error instanceof AggregateError) {
-    throw error;
-  }
-  const errorStderrRaw = error.stderr;
-  const errorStderr = Array.isArray(errorStderrRaw) ? errorStderrRaw.join("\n") : errorStderrRaw ?? "";
-  const errorMessage = error instanceof Error ? error.message : String(error);
-  const combinedMessage = `${errorStderr} ${errorMessage}`;
-  if (isConnectionError(error)) {
-    const semanticError = getError("EINVALIDNPMAUTH", { registry });
-    throw new AggregateError([semanticError], semanticError.message);
-  }
-  if (isAuthErrorMessage(combinedMessage)) {
-    const semanticError = getError("EINVALIDNPMAUTH", { registry });
-    throw new AggregateError([semanticError], semanticError.message);
-  }
-  throw error;
-};
-const verifyAuthContextAgainstCustomRegistry = async (npmrc, registry, context, pkgRoot = ".") => {
-  const { cwd, env, logger, stderr, stdout } = context;
-  try {
-    logger.log(`Running "pnpm publish --dry-run" to verify authentication on registry "${registry}"`);
-    const publishArgs = ["publish", pkgRoot, "--dry-run", "--tag=semantic-release-auth-check", "--registry", registry, "--no-git-checks"];
-    const publishOptions = {
-      cwd,
-      env: {
-        ...env,
-        NPM_CONFIG_USERCONFIG: npmrc
-      },
-      preferLocal: true,
-      timeout: 5e3
-      // 5 second timeout to prevent hanging when registry is unavailable
-    };
-    const publishResult = await execa("pnpm", publishArgs, publishOptions);
-    const stdoutString = Array.isArray(publishResult.stdout) ? publishResult.stdout.join("\n") : publishResult.stdout || "";
-    const stderrString = Array.isArray(publishResult.stderr) ? publishResult.stderr.join("\n") : publishResult.stderr || "";
-    if (stdoutString) {
-      stdout.write(stdoutString);
-    }
-    if (stderrString) {
-      stderr.write(stderrString);
-    }
-  } catch (error) {
-    handlePublishError(error, registry);
-  }
-};
-const verifyAuth = async (npmrc, package_, context, pkgRoot) => {
+const verifyAuth = async (npmrc, package_, context) => {
   const registry = getRegistry(package_, context);
   if (package_.name) {
     debug$2(`Checking OIDC trusted publishing for package "${package_.name}" on registry "${registry}"`);
@@ -668,9 +620,7 @@ const verifyAuth = async (npmrc, package_, context, pkgRoot) => {
     debug$2("Package name not found, skipping OIDC check and using NPM_TOKEN authentication");
   }
   await setNpmrcAuth(npmrc, registry, context);
-  const normalizedRegistry = normalizeUrl(registry);
-  const normalizedOfficialRegistry = normalizeUrl(OFFICIAL_REGISTRY);
-  await (normalizedRegistry === normalizedOfficialRegistry ? verifyAuthContextAgainstRegistry(npmrc, registry, context) : verifyAuthContextAgainstCustomRegistry(npmrc, registry, context, pkgRoot));
+  await verifyAuthContextAgainstRegistry(npmrc, registry, context);
 };
 
 const isString = (value) => typeof value === "string";
@@ -735,7 +685,7 @@ const verify = async (pluginConfig, context) => {
     if (shouldPublish(pluginConfig, packageJson)) {
       context.logger.log(`Verifying authentication for package "${packageJson.name ?? "unknown"}"`);
       const npmrc = getNpmrcPath(context.cwd, context.env);
-      await verifyAuth(npmrc, packageJson, context, pluginConfig.pkgRoot);
+      await verifyAuth(npmrc, packageJson, context);
     } else {
       context.logger.log(`Skipping authentication verification for package "${packageJson.name ?? "unknown"}" (publishing disabled)`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anolilab/semantic-release-pnpm",
-  "version": "8.1.4",
+  "version": "8.1.6",
   "description": "Semantic-release plugin to publish a npm package with pnpm.",
   "keywords": [
     "anolilab",