intuit / intuit/auto

Using auto shipit without npmtoken but with npm trusted publishing activated

Open
#2,506 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
2.5k
Forks
221
PR merge metrics
No merged PRs in 30d

Description

Hi, this morning a received an email from npmjs.org indicating that I need to switch imediately from
legacy access tokens to granular acces tokens or even better to use npm trusted publishing between github and npm via oidc.
In npm I created a trusted publisher for my github project and hence removed the npmtoken from my github actions release workflow. After doing that my release fails with the following error message:
`error Error: Failed to replace env in config: ${NPM_TOKEN}
at /usr/local/lib/node_modules/yarn/lib/cli.js:95453:13
at String.replace ()
at envReplace (/usr/local/lib/node_modules/yarn/lib/cli.js:95448:16)
at Function.normalizeConfig (/usr/local/lib/node_modules/yarn/lib/cli.js:31940:69)
at NpmRegistry. (/usr/local/lib/node_modules/yarn/lib/cli.js:31970:34)
at Generator.next ()
at step (/usr/local/lib/node_modules/yarn/lib/cli.js:310:30)
at /usr/local/lib/node_modules/yarn/lib/cli.js:321:13`
As I'm using `npx auto shipit --base-branch=main` to ship my code to npm I suppose this error has something to do with auto not supporting npm trusted publishing at the moment.
Or am I completely wrong an I've just not configured the whole thing properly.

I'm really looking foward on any info and advice on this matter.

Thank you in advance,

Stefan

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the GitHub Actions release workflow and the `npx auto shipit --base-branch=main` entry point. Reproduce the failure involving Yarn's `${NPM_TOKEN}` replacement and compare it with the reported npm trusted publishing configuration. Done means the release workflow can publish without the legacy token, with coverage for the relevant configuration or error path.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, node.js, typescript
Domain
ci-cd, release
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.