setup-node: .npmrc file with registry= not overwritten and causing 401 error
Example: https://github.com/rynz/node-test-protocol/pull/6
In this example exists an empty .npmrc
and when it is populated with registry=
an error occurs:
npm ERR! 401 Unauthorized - GET https://npm.pkg.github.com/rynz/prettier - could not retrieve user by token
For whatever reason, the registry=
is not being removed correctly like https://github.com/actions/setup-node/blob/master/src/authutil.ts#L41 is supposed to do.
About this issue
- Original URL
- State: closed
- Created 5 years ago
- Reactions: 5
- Comments: 17 (2 by maintainers)
I’m having a hard time believing that the registry line is not removed.
A config that will work both locally and in actions is to avoid specifying registry-url or scope in the
with
line, so that .npmrc is not modified, and use an explicit config in .npmrc.Assign OWNER_TOKEN from ${{secrets.GITHUB_TOKEN}} in actions, and assign it from a PAT locally.
Reopening because I’ve found the documentation that causes the bug in the first place: https://help.github.com/en/packages/using-github-packages-with-your-projects-ecosystem/configuring-npm-for-use-with-github-packages#publishing-a-package-using-a-local-npmrc-file
It states to use,
registry=https://npm.pkg.github.com/OWNER
where as we should be usingOWNER:registry=https://npm.pkg.github.com/
. Perhaps the documentation should be updated?Hello everyone. I’m going to close the issue because official GitHub documentation was updated. If you have any concerns feel free to ping us.
@joebowbeer This is my working
.npmrc
fileYour scoped registry should be defined as:
@rynz:registry=https://npm.pkg.github.com/
I think it is a bug that setup-node tries to remove
registry
. That is the default registry for non-scoped dependencies, which should be unrelated to your private packages.I think setup-node should only be removing the lines that it is redefining.
@bryanmacfarlane To avoid confusion, I think the doc needs improvement, as I wrote:
https://github.com/actions/setup-node/issues/87#issuecomment-593000328
Also, I expect setup-node has problems when the .npmrc already exists and contains registry entries. If not, the doc should better explain setup-node’s mods to pre-existing .npmrc
@0xc0d3r great. I was going to suggest always-auth=true and a trailing slash at end of registry url…
@0xc0d3r yes