inject $NPM_TOKEN into .npmrc for the user

[aleclarson]

Why is .npmrc searched for a Github token?

https://github.com/intuit/auto-release/blob/a4206047e02b006fb747d027595a66ef29dddb35/src/utils/github-token.ts#L25-L39

[aleclarson]

Also, why isn't process.env.NPM_TOKEN checked for, like GH_TOKEN is?

Could auto-release inject $NPM_TOKEN into .npmrc for the user? (potentially useful in CI builds)

[hipstersmoothie]

This is a GitHub enterprise thing. @adierkens can tell you more as I haven't encountered it.

Could auto-release inject $NPM_TOKEN into .npmrc for the user? (potentially useful in CI builds)

I like this. it should be do-able

[hipstersmoothie]

This feature should probably only be enable on the CI. If it were to run locally you might accidentally commit the token.

[hipstersmoothie]

Would this package get accomplish the desired behavior you're looking for?

https://www.npmjs.com/package/@hutson/set-npm-auth-token-for-ci

[aleclarson]

Sure, but a look at the source code reveals a very basic implementation, so it would be better to include it in auto-release than to force the user to install another dependency.

[hipstersmoothie]

It seems like it does what it does quite well though:

• handles rc files at multiple locations on any OS (using local-or-home-npmrc)
• checks if the token is already set
• handles the registry being set in the package.json
• correctly handles npmrc scope configuration (using registry-url)

This is a bunch of functionality that if we wanted to cover all the use cases, we would have to code all of the above as well (or at least use the same packages).

In a few other cases we do the same thing as well. We defer to parse-author to parse the git author correctly and parse-github-url for the github URL. So it wouldn't be a stretch to use a package to do this.

I also like depending on packages like these so there is less code duplication in the world. Any by using this package and finding problems with it we can solve problems for future devs too!

My main issue with the package is how they also ship the CLI with the API. For that I have opened an issue here

[aleclarson]

In the meantime, we should fork the package (and maybe even open a PR). 😁

[hipstersmoothie]

Yeah I plan on making a PR! Just want to know what the author would like. But the best path for that package is probably to do both: make a monorepo and use a smaller CLI library

[hipstersmoothie]

The maintainer already implemented this! https://gitlab.com/hyper-expanse/open-source/set-npm-auth-token-for-ci/issues/2