Repository navigation
.npmrc file with registry= not overwritten and causing 401 error #87
Description
Example: rynz/node-test-protocol#6
In this example exists an empty .npmrc and when it is populated with registry= an error occurs:
npm ERR! 401 Unauthorized - GET https://npm.pkg.github.com/rynz/prettier - could not retrieve user by token
For whatever reason, the registry= is not being removed correctly like https://github.com/actions/setup-node/blob/master/src/authutil.ts#L41 is supposed to do.
Activity
joebowbeer commentedon Feb 27, 2020
Your scoped registry should be defined as:
@rynz:registry=https://npm.pkg.github.com/I think it is a bug that setup-node tries to remove
registry. That is the default registry for non-scoped dependencies, which should be unrelated to your private packages.I think setup-node should only be removing the lines that it is redefining.
rynz commentedon Feb 27, 2020
Interesting, I'm not sure why I used the scoped registry style I did as it was a long time ago.
Should it be defined as:
@rynz:registry=https://npm.pkg.github.com/Why did you choose to use
/?joebowbeer commentedon Feb 27, 2020
The / doesn't seem to matter, at least for the GitHub registry, but it seems to be standard so I added it.
@rynz:registrydefines where@rynzpackages are located.registrydefines the default registry for unscoped (and possibly unresolved?) dependencies.The GPR documentation has been inconsistent and sometimes misleading; what I have written is based on my understanding of the npm and setup-node source.
rynz commentedon Feb 27, 2020
Yes I believe it was from the documentation that I used the scoped style I did. From the latest npm documentation it looks to be
@myscope:registry=https://mycustomregistry.example.orgis the standard now. Thanks for pointing me in the right direction @joebowbeer appreciate it.rynz commentedon Feb 27, 2020
Reopening because I've found the documentation that causes the bug in the first place: https://help.github.com/en/packages/using-github-packages-with-your-projects-ecosystem/configuring-npm-for-use-with-github-packages#publishing-a-package-using-a-local-npmrc-file
It states to use,
registry=https://npm.pkg.github.com/OWNERwhere as we should be usingOWNER:registry=https://npm.pkg.github.com/. Perhaps the documentation should be updated?joebowbeer commentedon Feb 29, 2020
After rereading the docs, it looks like github is providing a proxy registry at https://npm.pkg.github.com/OWNER
This registry, which npm commands will use as the default registry for unresolved dependencies, will serve
@ownerpackages from github and other packages from npmjs.org.The distinction between
@owner:registryand a registry proxy needs better documentation. (I prefer to avoid registry proxies and use explicit config instead.)The behavior of the
setup-nodeaction wrt registry-url also needs better doc. If scope is not specified, it will default to the owner scope and add a@owner:registry=while removing whatever defaultregistry=line may have existed, which is strange (#118). I also wonder if the registry-url forsetup-nodehandles the proxy registry url.rynz commentedon Feb 29, 2020
Thus, the original bug is still present - https://github.com/actions/setup-node/blob/master/src/authutil.ts#L41 is not removing the
registry=so while thenpmcommands work on your local machine,setup-nodewill return401 Unauthorized. As soon as you remove that line, or the.npmrcfile completely,setup-nodewill continue to work but then your localnpmwon't.joebowbeer commentedon Feb 29, 2020
I'm having a hard time believing that the registry line is not removed.
A config that will work both locally and in actions is to avoid specifying registry-url or scope in the
withline, so that .npmrc is not modified, and use an explicit config in .npmrc.Assign OWNER_TOKEN from ${{secrets.GITHUB_TOKEN}} in actions, and assign it from a PAT locally.
0xc0d3r commentedon Mar 18, 2020
@joebowbeer Do you mean that we have to explicitly create
.npmrcfile?joebowbeer commentedon Mar 18, 2020
@0xc0d3r yes
0xc0d3r commentedon Mar 18, 2020
@joebowbeer Cool. It's working! But it is working with
npm ionly. If I try to useyarnthen again I'm getting the same error. Any suggestions?0xc0d3r commentedon Mar 18, 2020
@joebowbeer yarnpkg/yarn#7552 (comment) solution worked for me. Thank you ❤
joebowbeer commentedon Mar 18, 2020
@0xc0d3r great. I was going to suggest always-auth=true and a trailing slash at end of registry url...
0xc0d3r commentedon Mar 18, 2020
@joebowbeer This is my working
.npmrcfilebryanmacfarlane commentedon Jun 30, 2020
Just to wrap up here, do we believe that this should be doc'd better or do you believe there's a bug here to fix?
joebowbeer commentedon Jun 30, 2020
@bryanmacfarlane To avoid confusion, I think the doc needs improvement, as I wrote:
#87 (comment)
Also, I expect setup-node has problems when the .npmrc already exists and contains registry entries. If not, the doc should better explain setup-node's mods to pre-existing .npmrc
dmitry-shibanov commentedon Dec 10, 2021
Hello everyone. I'm going to close the issue because official GitHub documentation was updated.
If you have any concerns feel free to ping us.
chore(deps-dev): bump @vercel/ncc from 0.24.1 to 0.25.1 (actions#87)