npm: NPM publish failing with OTP error even though "only Auth" 2FA enabled

Current behavior

I am trying to automate the process of publishing my npm package utilizing semantic-release, commitizen and github actions. I am committing a semver commit (utilzing commitizen) and when I am trying to run semantic-release through github actions, and while having set │ two-factor auth │ auth-only in npm, semantic-release is unable to publish, throwing the following error:

'npm ERR! code EOTP\n' +
    'npm ERR! This operation requires a one-time password from your authenticator.\n' +
    'npm ERR! You can provide a one-time password by passing --otp=<code> to the command you ran.\n' +
    'npm ERR! If you already provided a one-time password then it is likely that you either typoed\n' +
    'npm ERR! it, or it timed out. Please try again.\n' +

It seems that the prepare step is executed properly, but then semantic-release fails to publish my package to NPM. I think the service still requests multi-factor authentication, even if I have set .

Weirdly enough, even when npm publish fails, the github release is successful.

Here’s the github workflow logs: https://github.com/Trulioo/trulioo-react/commit/f99ed78abadc5bd20f58c9fc3261c3745818c99c/checks?check_suite_id=276381108

Expected behavior

Newly versioned package should be published successfully to npm. Version number should automatically be managed. This is my github repo https://github.com/Trulioo/trulioo-react and this is the package hosted in npmjs https://www.npmjs.com/package/trulioo-react

Environment

I am using github actions and I set an NPM_TOKEN and GITHUB_TOKEN in my environment variables (secrets)

Logs:

2019-10-22T17:59:18.9107848Z [5:59:18 PM] [semantic-release] › ✔  Completed step "prepare" of plugin "@semantic-release/npm"
2019-10-22T17:59:21.6412416Z [5:59:21 PM] [semantic-release] › ✔  Created tag v1.1.4
2019-10-22T17:59:21.6415377Z [5:59:21 PM] [semantic-release] › ℹ  Start step "publish" of plugin "@semantic-release/npm"
2019-10-22T17:59:21.6510708Z [5:59:21 PM] [semantic-release] [@semantic-release/npm] › ℹ  Publishing version 1.1.4 to npm registry
2019-10-22T17:59:22.3254878Z 
2019-10-22T17:59:22.3257302Z > trulioo-react@1.1.4 prepare /home/runner/work/trulioo-react/trulioo-react
2019-10-22T17:59:22.3258002Z > npm run transpile
2019-10-22T17:59:22.3258413Z 
2019-10-22T17:59:23.1600124Z 
2019-10-22T17:59:23.1601685Z > trulioo-react@1.1.4 transpile /home/runner/work/trulioo-react/trulioo-react
2019-10-22T17:59:23.1602198Z > babel src -d ./dist --ignore **/tests/
2019-10-22T17:59:23.1602324Z 
2019-10-22T17:59:24.2230896Z Successfully compiled 7 files with Babel.
2019-10-22T17:59:24.3223081Z npm notice 
2019-10-22T17:59:24.3224907Z npm notice 📦  trulioo-react@1.1.4
2019-10-22T17:59:24.3225585Z npm notice === Tarball Contents === 
2019-10-22T17:59:24.3261315Z npm notice 11.4kB LICENSE                       
2019-10-22T17:59:24.3262033Z npm notice 1.7kB  dist/reducers/apiReducers.js  
2019-10-22T17:59:24.3262600Z npm notice 1.7kB  dist/EmbedID.js               
2019-10-22T17:59:24.3263223Z npm notice 13.2kB dist/actions/index.js         
2019-10-22T17:59:24.3263786Z npm notice 441B   dist/index.js                 
2019-10-22T17:59:24.3264312Z npm notice 442B   dist/reducers/index.js        
2019-10-22T17:59:24.3264825Z npm notice 6.3kB  dist/components/TruliooForm.js
2019-10-22T17:59:24.3265329Z npm notice 377B   dist/actions/types.js         
2019-10-22T17:59:24.3265842Z npm notice 3.5kB  package.json                  
2019-10-22T17:59:24.3266570Z npm notice 215B   CHANGELOG.md                  
2019-10-22T17:59:24.3267698Z npm notice 5.8kB  README.md                     
2019-10-22T17:59:24.3268272Z npm notice === Tarball Details === 
2019-10-22T17:59:24.3274898Z npm notice name:          trulioo-react                           
2019-10-22T17:59:24.3275679Z npm notice version:       1.1.4                                   
2019-10-22T17:59:24.3276278Z npm notice package size:  12.6 kB                                 
2019-10-22T17:59:24.3276877Z npm notice unpacked size: 45.1 kB                                 
2019-10-22T17:59:24.3278408Z npm notice shasum:        ff97947cae800b35c088ac07d768820544a9dc94
2019-10-22T17:59:24.3279867Z npm notice integrity:     sha512-/2TtkuCTnagVC[...]l+MpXVUzOGDNA==
2019-10-22T17:59:24.3280951Z npm notice total files:   11                                      
2019-10-22T17:59:24.3281480Z npm notice 
2019-10-22T17:59:25.5924509Z npm ERR! code EOTP
2019-10-22T17:59:25.5936396Z npm ERR! This operation requires a one-time password from your authenticator.
2019-10-22T17:59:25.5937693Z npm ERR! You can provide a one-time password by passing --otp=<code> to the command you ran.
2019-10-22T17:59:25.5938491Z npm ERR! If you already provided a one-time password then it is likely that you either typoed
2019-10-22T17:59:25.5938789Z npm ERR! it, or it timed out. Please try again.
2019-10-22T17:59:25.6168292Z 
2019-10-22T17:59:25.6169200Z npm ERR! A complete log of this run can be found in:
2019-10-22T17:59:25.6170529Z npm ERR!     /home/runner/.npm/_logs/2019-10-22T17_59_25_594Z-debug.log
2019-10-22T17:59:25.6221799Z [5:59:25 PM] [semantic-release] › ✖  Failed step "publish" of plugin "@semantic-release/npm"
2019-10-22T17:59:25.6258401Z [5:59:25 PM] [semantic-release] › ✖  An error occurred while running semantic-release: Error: Command failed with exit code 1 (EPERM): npm publish /home/runner/work/trulioo-react/trulioo-react --registry https://registry.npmjs.org/
2019-10-22T17:59:25.6260047Z     at makeError (/home/runner/work/trulioo-react/trulioo-react/node_modules/@semantic-release/npm/node_modules/execa/lib/error.js:59:11)
2019-10-22T17:59:25.6261306Z     at handlePromise (/home/runner/work/trulioo-react/trulioo-react/node_modules/@semantic-release/npm/node_modules/execa/index.js:112:26)
2019-10-22T17:59:25.6261960Z     at processTicksAndRejections (internal/process/task_queues.js:93:5)
2019-10-22T17:59:25.6264907Z     at async module.exports (/home/runner/work/trulioo-react/trulioo-react/node_modules/@semantic-release/npm/lib/publish.js:30:5)
2019-10-22T17:59:25.6267948Z     at async validator (/home/runner/work/trulioo-react/trulioo-react/node_modules/semantic-release/lib/plugins/normalize.js:34:24)
2019-10-22T17:59:25.6269094Z     at async /home/runner/work/trulioo-react/trulioo-react/node_modules/semantic-release/lib/plugins/pipeline.js:37:34
2019-10-22T17:59:25.6269669Z     at async Promise.all (index 0)
2019-10-22T17:59:25.6270544Z     at async next (/home/runner/work/trulioo-react/trulioo-react/node_modules/p-reduce/index.js:16:18) {
2019-10-22T17:59:25.6271653Z   command: 'npm publish /home/runner/work/trulioo-react/trulioo-react --registry https://registry.npmjs.org/',
2019-10-22T17:59:25.6272197Z   exitCode: 1,
2019-10-22T17:59:25.6272850Z   exitCodeName: 'EPERM',
2019-10-22T17:59:25.6273550Z   stdout: '\n' +
2019-10-22T17:59:25.6274500Z     '> trulioo-react@1.1.4 prepare /home/runner/work/trulioo-react/trulioo-react\n' +
2019-10-22T17:59:25.6275274Z     '> npm run transpile\n' +
2019-10-22T17:59:25.6278374Z     '\n' +
2019-10-22T17:59:25.6279168Z     '\n' +
2019-10-22T17:59:25.6280030Z     '> trulioo-react@1.1.4 transpile /home/runner/work/trulioo-react/trulioo-react\n' +
2019-10-22T17:59:25.6280953Z     '> babel src -d ./dist --ignore **/tests/\n' +
2019-10-22T17:59:25.6281585Z     '\n' +
2019-10-22T17:59:25.6282476Z     'Successfully compiled 7 files with Babel.',
2019-10-22T17:59:25.6283211Z   stderr: 'npm notice \n' +
2019-10-22T17:59:25.6283970Z     'npm notice 📦  trulioo-react@1.1.4\n' +
2019-10-22T17:59:25.6285945Z     'npm notice === Tarball Contents === \n' +
2019-10-22T17:59:25.6286815Z     'npm notice 11.4kB LICENSE                       \n' +
2019-10-22T17:59:25.6288031Z     'npm notice 1.7kB  dist/reducers/apiReducers.js  \n' +
2019-10-22T17:59:25.6288788Z     'npm notice 1.7kB  dist/EmbedID.js               \n' +
2019-10-22T17:59:25.6363668Z     'npm notice 13.2kB dist/actions/index.js         \n' +
2019-10-22T17:59:25.6424136Z     'npm notice 441B   dist/index.js                 \n' +
2019-10-22T17:59:25.6424797Z     'npm notice 442B   dist/reducers/index.js        \n' +
2019-10-22T17:59:25.6425251Z     'npm notice 6.3kB  dist/components/TruliooForm.js\n' +
2019-10-22T17:59:25.6425687Z     'npm notice 377B   dist/actions/types.js         \n' +
2019-10-22T17:59:25.6426132Z     'npm notice 3.5kB  package.json                  \n' +
2019-10-22T17:59:25.6426572Z     'npm notice 215B   CHANGELOG.md                  \n' +
2019-10-22T17:59:25.6427007Z     'npm notice 5.8kB  README.md                     \n' +
2019-10-22T17:59:25.6427535Z     'npm notice === Tarball Details === \n' +
2019-10-22T17:59:25.6428020Z     'npm notice name:          trulioo-react                           \n' +
2019-10-22T17:59:25.6428512Z     'npm notice version:       1.1.4                                   \n' +
2019-10-22T17:59:25.6429000Z     'npm notice package size:  12.6 kB                                 \n' +
2019-10-22T17:59:25.6429485Z     'npm notice unpacked size: 45.1 kB                                 \n' +
2019-10-22T17:59:25.6430317Z     'npm notice shasum:        ff97947cae800b35c088ac07d768820544a9dc94\n' +
2019-10-22T17:59:25.6430919Z     'npm notice integrity:     sha512-/2TtkuCTnagVC[...]l+MpXVUzOGDNA==\n' +
2019-10-22T17:59:25.6431391Z     'npm notice total files:   11                                      \n' +
2019-10-22T17:59:25.6431720Z     'npm notice \n' +
2019-10-22T17:59:25.6432026Z     'npm ERR! code EOTP\n' +
2019-10-22T17:59:25.6432452Z     'npm ERR! This operation requires a one-time password from your authenticator.\n' +
2019-10-22T17:59:25.6432987Z     'npm ERR! You can provide a one-time password by passing --otp=<code> to the command you ran.\n' +
2019-10-22T17:59:25.6433492Z     'npm ERR! If you already provided a one-time password then it is likely that you either typoed\n' +
2019-10-22T17:59:25.6433900Z     'npm ERR! it, or it timed out. Please try again.\n' +
2019-10-22T17:59:25.6434186Z     '\n' +
2019-10-22T17:59:25.6434692Z     'npm ERR! A complete log of this run can be found in:\n' +
2019-10-22T17:59:25.6435158Z     'npm ERR!     /home/runner/.npm/_logs/2019-10-22T17_59_25_594Z-debug.log',
2019-10-22T17:59:25.6435475Z   all: '\n' +
2019-10-22T17:59:25.6435908Z     '> trulioo-react@1.1.4 prepare /home/runner/work/trulioo-react/trulioo-react\n' +
2019-10-22T17:59:25.6436251Z     '> npm run transpile\n' +
2019-10-22T17:59:25.6436533Z     '\n' +
2019-10-22T17:59:25.6436798Z     '\n' +
2019-10-22T17:59:25.6437332Z     '> trulioo-react@1.1.4 transpile /home/runner/work/trulioo-react/trulioo-react\n' +
2019-10-22T17:59:25.6437748Z     '> babel src -d ./dist --ignore **/tests/\n' +
2019-10-22T17:59:25.6438043Z     '\n' +
2019-10-22T17:59:25.6438395Z     'Successfully compiled 7 files with Babel.\n' +
2019-10-22T17:59:25.6438708Z     'npm notice \n' +
2019-10-22T17:59:25.6439069Z     'npm notice 📦  trulioo-react@1.1.4\n' +
2019-10-22T17:59:25.6439427Z     'npm notice === Tarball Contents === \n' +
2019-10-22T17:59:25.6439806Z     'npm notice 11.4kB LICENSE                       \n' +
2019-10-22T17:59:25.6440217Z     'npm notice 1.7kB  dist/reducers/apiReducers.js  \n' +
2019-10-22T17:59:25.6440743Z     'npm notice 1.7kB  dist/EmbedID.js               \n' +
2019-10-22T17:59:25.6441175Z     'npm notice 13.2kB dist/actions/index.js         \n' +
2019-10-22T17:59:25.6441991Z     'npm notice 441B   dist/index.js                 \n' +
2019-10-22T17:59:25.6442429Z     'npm notice 442B   dist/reducers/index.js        \n' +
2019-10-22T17:59:25.6443253Z     'npm notice 6.3kB  dist/components/TruliooForm.js\n' +
2019-10-22T17:59:25.6443985Z     'npm notice 377B   dist/actions/types.js         \n' +
2019-10-22T17:59:25.6444469Z     'npm notice 3.5kB  package.json                  \n' +
2019-10-22T17:59:25.6445061Z     'npm notice 215B   CHANGELOG.md                  \n' +
2019-10-22T17:59:25.6445562Z     'npm notice 5.8kB  README.md                     \n' +
2019-10-22T17:59:25.6445964Z     'npm notice === Tarball Details === \n' +
2019-10-22T17:59:25.6446441Z     'npm notice name:          trulioo-react                           \n' +
2019-10-22T17:59:25.6446962Z     'npm notice version:       1.1.4                                   \n' +
2019-10-22T17:59:25.6447512Z     'npm notice package size:  12.6 kB                                 \n' +
2019-10-22T17:59:25.6447991Z     'npm notice unpacked size: 45.1 kB                                 \n' +
2019-10-22T17:59:25.6448474Z     'npm notice shasum:        ff97947cae800b35c088ac07d768820544a9dc94\n' +
2019-10-22T17:59:25.6448975Z     'npm notice integrity:     sha512-/2TtkuCTnagVC[...]l+MpXVUzOGDNA==\n' +
2019-10-22T17:59:25.6449901Z     'npm notice total files:   11                                      \n' +
2019-10-22T17:59:25.6450620Z     'npm notice \n' +
2019-10-22T17:59:25.6450962Z     'npm ERR! code EOTP\n' +
2019-10-22T17:59:25.6452227Z     'npm ERR! This operation requires a one-time password from your authenticator.\n' +
2019-10-22T17:59:25.6452846Z     'npm ERR! You can provide a one-time password by passing --otp=<code> to the command you ran.\n' +
2019-10-22T17:59:25.6454139Z     'npm ERR! If you already provided a one-time password then it is likely that you either typoed\n' +
2019-10-22T17:59:25.6454630Z     'npm ERR! it, or it timed out. Please try again.\n' +
2019-10-22T17:59:25.6454985Z     '\n' +
2019-10-22T17:59:25.6455414Z     'npm ERR! A complete log of this run can be found in:\n' +
2019-10-22T17:59:25.6455915Z     'npm ERR!     /home/runner/.npm/_logs/2019-10-22T17_59_25_594Z-debug.log',
2019-10-22T17:59:25.6456116Z   failed: true,
2019-10-22T17:59:25.6456257Z   timedOut: false,
2019-10-22T17:59:25.6456432Z   isCanceled: false,
2019-10-22T17:59:25.6456599Z   killed: false,
2019-10-22T17:59:25.6456766Z   signal: undefined,
2019-10-22T17:59:25.6457153Z   pluginName: '@semantic-release/npm'
2019-10-22T17:59:25.6457605Z }
2019-10-22T17:59:25.6458525Z Error: Command failed with exit code 1 (EPERM): npm publish /home/runner/work/trulioo-react/trulioo-react --registry https://registry.npmjs.org/
2019-10-22T17:59:25.6459303Z     at makeError (/home/runner/work/trulioo-react/trulioo-react/node_modules/@semantic-release/npm/node_modules/execa/lib/error.js:59:11)
2019-10-22T17:59:25.6460060Z     at handlePromise (/home/runner/work/trulioo-react/trulioo-react/node_modules/@semantic-release/npm/node_modules/execa/index.js:112:26)
2019-10-22T17:59:25.6460813Z     at processTicksAndRejections (internal/process/task_queues.js:93:5)
2019-10-22T17:59:25.6461480Z     at async module.exports (/home/runner/work/trulioo-react/trulioo-react/node_modules/@semantic-release/npm/lib/publish.js:30:5)
2019-10-22T17:59:25.6462138Z     at async validator (/home/runner/work/trulioo-react/trulioo-react/node_modules/semantic-release/lib/plugins/normalize.js:34:24)
2019-10-22T17:59:25.6462758Z     at async /home/runner/work/trulioo-react/trulioo-react/node_modules/semantic-release/lib/plugins/pipeline.js:37:34
2019-10-22T17:59:25.6462990Z     at async Promise.all (index 0)
2019-10-22T17:59:25.6463525Z     at async next (/home/runner/work/trulioo-react/trulioo-react/node_modules/p-reduce/index.js:16:18) {
2019-10-22T17:59:25.6464115Z   command: 'npm publish /home/runner/work/trulioo-react/trulioo-react --registry https://registry.npmjs.org/',
2019-10-22T17:59:25.6464668Z   exitCode: 1,
2019-10-22T17:59:25.6465049Z   exitCodeName: 'EPERM',
2019-10-22T17:59:25.6465414Z   stdout: '\n' +
2019-10-22T17:59:25.6466092Z     '> trulioo-react@1.1.4 prepare /home/runner/work/trulioo-react/trulioo-react\n' +
2019-10-22T17:59:25.6466593Z     '> npm run transpile\n' +
2019-10-22T17:59:25.6466942Z     '\n' +
2019-10-22T17:59:25.6467255Z     '\n' +
2019-10-22T17:59:25.6468181Z     '> trulioo-react@1.1.4 transpile /home/runner/work/trulioo-react/trulioo-react\n' +
2019-10-22T17:59:25.6468626Z     '> babel src -d ./dist --ignore **/tests/\n' +
2019-10-22T17:59:25.6468945Z     '\n' +
2019-10-22T17:59:25.6469324Z     'Successfully compiled 7 files with Babel.',
2019-10-22T17:59:25.6469697Z   stderr: 'npm notice \n' +
2019-10-22T17:59:25.6470090Z     'npm notice 📦  trulioo-react@1.1.4\n' +
2019-10-22T17:59:25.6470522Z     'npm notice === Tarball Contents === \n' +
2019-10-22T17:59:25.6471101Z     'npm notice 11.4kB LICENSE                       \n' +
2019-10-22T17:59:25.6471550Z     'npm notice 1.7kB  dist/reducers/apiReducers.js  \n' +
2019-10-22T17:59:25.6472012Z     'npm notice 1.7kB  dist/EmbedID.js               \n' +
2019-10-22T17:59:25.6472422Z     'npm notice 13.2kB dist/actions/index.js         \n' +
2019-10-22T17:59:25.6472873Z     'npm notice 441B   dist/index.js                 \n' +
2019-10-22T17:59:25.6473452Z     'npm notice 442B   dist/reducers/index.js        \n' +
2019-10-22T17:59:25.6473919Z     'npm notice 6.3kB  dist/components/TruliooForm.js\n' +
2019-10-22T17:59:25.6474386Z     'npm notice 377B   dist/actions/types.js         \n' +
2019-10-22T17:59:25.6475071Z     'npm notice 3.5kB  package.json                  \n' +
2019-10-22T17:59:25.6475539Z     'npm notice 215B   CHANGELOG.md                  \n' +
2019-10-22T17:59:25.6476006Z     'npm notice 5.8kB  README.md                     \n' +
2019-10-22T17:59:25.6476443Z     'npm notice === Tarball Details === \n' +
2019-10-22T17:59:25.6476950Z     'npm notice name:          trulioo-react                           \n' +
2019-10-22T17:59:25.6477879Z     'npm notice version:       1.1.4                                   \n' +
2019-10-22T17:59:25.6478426Z     'npm notice package size:  12.6 kB                                 \n' +
2019-10-22T17:59:25.6478940Z     'npm notice unpacked size: 45.1 kB                                 \n' +
2019-10-22T17:59:25.6479456Z     'npm notice shasum:        ff97947cae800b35c088ac07d768820544a9dc94\n' +
2019-10-22T17:59:25.6479985Z     'npm notice integrity:     sha512-/2TtkuCTnagVC[...]l+MpXVUzOGDNA==\n' +
2019-10-22T17:59:25.6480461Z     'npm notice total files:   11                                      \n' +
2019-10-22T17:59:25.6480978Z     'npm notice \n' +
2019-10-22T17:59:25.6481352Z     'npm ERR! code EOTP\n' +
2019-10-22T17:59:25.6481849Z     'npm ERR! This operation requires a one-time password from your authenticator.\n' +
2019-10-22T17:59:25.6482419Z     'npm ERR! You can provide a one-time password by passing --otp=<code> to the command you ran.\n' +
2019-10-22T17:59:25.6482998Z     'npm ERR! If you already provided a one-time password then it is likely that you either typoed\n' +
2019-10-22T17:59:25.6483470Z     'npm ERR! it, or it timed out. Please try again.\n' +
2019-10-22T17:59:25.6483783Z     '\n' +
2019-10-22T17:59:25.6484222Z     'npm ERR! A complete log of this run can be found in:\n' +
2019-10-22T17:59:25.6484877Z     'npm ERR!     /home/runner/.npm/_logs/2019-10-22T17_59_25_594Z-debug.log',
2019-10-22T17:59:25.6485262Z   all: '\n' +
2019-10-22T17:59:25.6485766Z     '> trulioo-react@1.1.4 prepare /home/runner/work/trulioo-react/trulioo-react\n' +
2019-10-22T17:59:25.6486191Z     '> npm run transpile\n' +
2019-10-22T17:59:25.6486539Z     '\n' +
2019-10-22T17:59:25.6486888Z     '\n' +
2019-10-22T17:59:25.6487938Z     '> trulioo-react@1.1.4 transpile /home/runner/work/trulioo-react/trulioo-react\n' +
2019-10-22T17:59:25.6488548Z     '> babel src -d ./dist --ignore **/tests/\n' +
2019-10-22T17:59:25.6488879Z     '\n' +
2019-10-22T17:59:25.6489311Z     'Successfully compiled 7 files with Babel.\n' +
2019-10-22T17:59:25.6489703Z     'npm notice \n' +
2019-10-22T17:59:25.6490138Z     'npm notice 📦  trulioo-react@1.1.4\n' +
2019-10-22T17:59:25.6490692Z     'npm notice === Tarball Contents === \n' +
2019-10-22T17:59:25.6491604Z     'npm notice 11.4kB LICENSE                       \n' +
2019-10-22T17:59:25.6492063Z     'npm notice 1.7kB  dist/reducers/apiReducers.js  \n' +
2019-10-22T17:59:25.6492519Z     'npm notice 1.7kB  dist/EmbedID.js               \n' +
2019-10-22T17:59:25.6492965Z     'npm notice 13.2kB dist/actions/index.js         \n' +
2019-10-22T17:59:25.6493367Z     'npm notice 441B   dist/index.js                 \n' +
2019-10-22T17:59:25.6493830Z     'npm notice 442B   dist/reducers/index.js        \n' +
2019-10-22T17:59:25.6494403Z     'npm notice 6.3kB  dist/components/TruliooForm.js\n' +
2019-10-22T17:59:25.6494872Z     'npm notice 377B   dist/actions/types.js         \n' +
2019-10-22T17:59:25.6495335Z     'npm notice 3.5kB  package.json                  \n' +
2019-10-22T17:59:25.6495803Z     'npm notice 215B   CHANGELOG.md                  \n' +
2019-10-22T17:59:25.6496469Z     'npm notice 5.8kB  README.md                     \n' +
2019-10-22T17:59:25.6496912Z     'npm notice === Tarball Details === \n' +
2019-10-22T17:59:25.6497668Z     'npm notice name:          trulioo-react                           \n' +
2019-10-22T17:59:25.6498271Z     'npm notice version:       1.1.4                                   \n' +
2019-10-22T17:59:25.6498743Z     'npm notice package size:  12.6 kB                                 \n' +
2019-10-22T17:59:25.6499271Z     'npm notice unpacked size: 45.1 kB                                 \n' +
2019-10-22T17:59:25.6499811Z     'npm notice shasum:        ff97947cae800b35c088ac07d768820544a9dc94\n' +
2019-10-22T17:59:25.6500325Z     'npm notice integrity:     sha512-/2TtkuCTnagVC[...]l+MpXVUzOGDNA==\n' +
2019-10-22T17:59:25.6500940Z     'npm notice total files:   11                                      \n' +
2019-10-22T17:59:25.6501311Z     'npm notice \n' +
2019-10-22T17:59:25.6501819Z     'npm ERR! code EOTP\n' +
2019-10-22T17:59:25.6502310Z     'npm ERR! This operation requires a one-time password from your authenticator.\n' +
2019-10-22T17:59:25.6502868Z     'npm ERR! You can provide a one-time password by passing --otp=<code> to the command you ran.\n' +
2019-10-22T17:59:25.6503437Z     'npm ERR! If you already provided a one-time password then it is likely that you either typoed\n' +
2019-10-22T17:59:25.6503916Z     'npm ERR! it, or it timed out. Please try again.\n' +
2019-10-22T17:59:25.6504275Z     '\n' +
2019-10-22T17:59:25.6504798Z     'npm ERR! A complete log of this run can be found in:\n' +
2019-10-22T17:59:25.6505316Z     'npm ERR!     /home/runner/.npm/_logs/2019-10-22T17_59_25_594Z-debug.log',
2019-10-22T17:59:25.6505702Z   failed: true,
2019-10-22T17:59:25.6506067Z   timedOut: false,
2019-10-22T17:59:25.6506435Z   isCanceled: false,
2019-10-22T17:59:25.6506810Z   killed: false,
2019-10-22T17:59:25.6507178Z   signal: undefined,
2019-10-22T17:59:25.6507867Z   pluginName: '@semantic-release/npm'
2019-10-22T17:59:25.6508068Z }npm ERR! code ELIFECYCLE
2019-10-22T17:59:25.6508263Z npm ERR! errno 1
2019-10-22T17:59:25.6508766Z npm ERR! trulioo-react@ semantic-release: `semantic-release`
2019-10-22T17:59:25.6508993Z npm ERR! Exit status 1
2019-10-22T17:59:25.6509166Z npm ERR! 
2019-10-22T17:59:25.6509814Z npm ERR! Failed at the trulioo-react@ semantic-release script.
2019-10-22T17:59:25.6510234Z npm ERR! This is probably not a problem with npm. There is likely additional logging output above.
2019-10-22T17:59:25.6610280Z 
2019-10-22T17:59:25.6610683Z npm ERR! A complete log of this run can be found in:
2019-10-22T17:59:25.6611851Z npm ERR!     /home/runner/.npm/_logs/2019-10-22T17_59_25_642Z-debug.log
2019-10-22T17:59:25.6670462Z ##[error]Process completed with exit code 1.
2019-10-22T17:59:25.6787436Z Cleaning up orphan processes

I can’t seem to figure out whether that’s a semantic-release issue, or NPM one.

About this issue

  • Original URL
  • State: closed
  • Created 5 years ago
  • Reactions: 2
  • Comments: 23 (7 by maintainers)

Most upvoted comments

Make sure you’re creating a proper access token, in this case “Automation” would be the right one: Screenshot 2021-08-24 at 11 54 30

+14
danilowoz on Aug 24, 2021

That’s because the second time nothing happens because there is no commit since the last release. Just set up your npm account to use auth-only 2FA.

+14
pvdlg on Oct 22, 2019

It seems your 2FA is not set to auth-only but to auth-and-writes. Otherwise npm wouldn’t ask for an OTP on npm publish.

+11
pvdlg on Oct 22, 2019

Hi All.

I think I found a way to fix this,

I know many of us already set up 2fa to auth only, but still get the error.

what I tried today, is to

  1. set 2fa to auth only again,
  2. and regenerate a new token

and it worked.

it even did not make sense to me, but it did work for me.

+4
tim-hub on Sep 26, 2023

My request is to re-open this issue.

My account is auth only image

And my package is going to get published first time. I have created my NPM token, once from npmjs.com && next time from npm create token. Both ways, my CI pipeline fails.

Open project, which is trying to get published - https://github.com/varora1406/linked-list

logs are similar to what were posted before here

npm notice === Tarball Details === 
npm notice name:          linked-list                             
npm notice version:       1.1.0                                   
npm notice package size:  4.9 kB                                  
npm notice unpacked size: 18.7 kB                                 
npm notice shasum:        9a8988481028e2df2ad4238c8542c0c51d19990f
npm notice integrity:     sha512-2mxlXVw37hYqE[...]hBZAxlZ7Qqi9A==
npm notice total files:   10                                      
npm notice 
npm ERR! code EOTP
npm ERR! This operation requires a one-time password from your authenticator.
npm ERR! You can provide a one-time password by passing --otp=<code> to the command you ran.
npm ERR! If you already provided a one-time password then it is likely that you either typoed
npm ERR! it, or it timed out. Please try again.

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/runner/.npm/_logs/2020-07-14T17_03_16_612Z-debug.log
[5:03:16 PM] [semantic-release] › ✖  Failed step "publish" of plugin "@semantic-release/npm"
[5:03:16 PM] [semantic-release] › ✖  An error occurred while running semantic-release: Error: Command failed with exit code 1: npm publish /home/runner/work/linked-list/linked-list --userconfig /tmp/41a1b35a590935ecdbb921e40a7a2ec8/.npmrc --tag latest --registry https://registry.npmjs.org/
npm WARN lifecycle The node binary used for scripts is /tmp/yarn--1594746183461-0.4594897097620074/node but npm is using /opt/hostedtoolcache/node/12.18.2/x64/bin/node itself. Use the `--scripts-prepend-node-path` option to include the path for the node binary npm was executed with.
+3
vaibhavarora14 on Jul 14, 2020

For anyone that finds this: Individual Packages can be set to require 2FA for publishing, the auth-only setting only affects your account. Make sure the package setting to require 2FA is also disabled.

+2
moonmeister on Mar 10, 2020

Managed to solve this by configuring 2FA to auth-only in npm 🎉

+2
mkotsollaris on Nov 23, 2019
Read more comments on GitHub
← gitlab: RequestError: self-signed certificate
npm: NPM publish: SemanticReleaseError: Invalid npm token. →