.npmrc file with registry= not overwritten and causing 401 error

[rynz]

Example: rynz/node-test-protocol#6

In this example exists an empty .npmrc and when it is populated with registry= an error occurs:

npm ERR! 401 Unauthorized - GET https://npm.pkg.github.com/rynz/prettier - could not retrieve user by token

For whatever reason, the registry= is not being removed correctly like https://github.com/actions/setup-node/blob/master/src/authutil.ts#L41 is supposed to do.

[joebowbeer]

Your scoped registry should be defined as:

@rynz:registry=https://npm.pkg.github.com/

I think it is a bug that setup-node tries to remove registry. That is the default registry for non-scoped dependencies, which should be unrelated to your private packages.

I think setup-node should only be removing the lines that it is redefining.

[rynz]

Interesting, I'm not sure why I used the scoped registry style I did as it was a long time ago.
Should it be defined as:

@rynz:registry=https://npm.pkg.github.com/

Why did you choose to use /?

[joebowbeer]

The / doesn't seem to matter, at least for the GitHub registry, but it seems to be standard so I added it.

@rynz:registry defines where @rynz packages are located. registry defines the default registry for unscoped (and possibly unresolved?) dependencies.

The GPR documentation has been inconsistent and sometimes misleading; what I have written is based on my understanding of the npm and setup-node source.

[rynz]

Yes I believe it was from the documentation that I used the scoped style I did. From the latest npm documentation it looks to be @myscope:registry=https://mycustomregistry.example.org is the standard now. Thanks for pointing me in the right direction @joebowbeer appreciate it.

[rynz]

Reopening because I've found the documentation that causes the bug in the first place: https://help.github.com/en/packages/using-github-packages-with-your-projects-ecosystem/configuring-npm-for-use-with-github-packages#publishing-a-package-using-a-local-npmrc-file

It states to use, registry=https://npm.pkg.github.com/OWNER where as we should be using OWNER:registry=https://npm.pkg.github.com/. Perhaps the documentation should be updated?

[joebowbeer]

It states to use, registry=https://npm.pkg.github.com/OWNER where as we should be using OWNER:registry=https://npm.pkg.github.com/. Perhaps the documentation should be updated?

After rereading the docs, it looks like github is providing a proxy registry at https://npm.pkg.github.com/OWNER

This registry, which npm commands will use as the default registry for unresolved dependencies, will serve @owner packages from github and other packages from npmjs.org.

The distinction between @owner:registry and a registry proxy needs better documentation. (I prefer to avoid registry proxies and use explicit config instead.)

The behavior of the setup-node action wrt registry-url also needs better doc. If scope is not specified, it will default to the owner scope and add a @owner:registry= while removing whatever default registry= line may have existed, which is strange (#118). I also wonder if the registry-url for setup-node handles the proxy registry url.

[rynz]

Thus, the original bug is still present - https://github.com/actions/setup-node/blob/master/src/authutil.ts#L41 is not removing the registry= so while the npm commands work on your local machine, setup-node will return 401 Unauthorized. As soon as you remove that line, or the .npmrc file completely, setup-node will continue to work but then your local npm won't.

[joebowbeer]

I'm having a hard time believing that the registry line is not removed.

A config that will work both locally and in actions is to avoid specifying registry-url or scope in the with line, so that .npmrc is not modified, and use an explicit config in .npmrc.

@owner:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=$OWNER_TOKEN

Assign OWNER_TOKEN from ${{secrets.GITHUB_TOKEN}} in actions, and assign it from a PAT locally.

[0xc0d3r]

A config that will work both locally and in actions is to avoid specifying registry-url or scope in the with line, so that .npmrc is not modified, and use an explicit config in .npmrc.

@joebowbeer Do you mean that we have to explicitly create .npmrc file?

[joebowbeer]

@0xc0d3r yes

[0xc0d3r]

@joebowbeer Cool. It's working! But it is working with npm i only. If I try to use yarn then again I'm getting the same error. Any suggestions?

[0xc0d3r]

@joebowbeer yarnpkg/yarn#7552 (comment) solution worked for me. Thank you ❤

[joebowbeer]

@0xc0d3r great. I was going to suggest always-auth=true and a trailing slash at end of registry url...