ci: make the GitHub Packages credential survive a pnpm major - #13
Merged
Merged
Conversation
All three jobs wrote the token into ~/.npmrc. That works on pnpm 9, which this repo pins, and silently stops working on pnpm 11: pnpm 11 keeps its own credential store and sends tokens only from there, so a token in ~/.npmrc is still listed back in pnpm's "These authorization settings were found" output while never reaching the request. It fails as a 401 saying no authorization header was set, which reads like a revoked token rather than a config change. `pnpm config set` writes wherever the running pnpm actually reads, so it is correct on 9 and on 11. Also guards against an empty secret. The same 401 appears when NODE_AUTH_TOKEN holds nothing, and the registry error names neither the secret nor the repo — the sibling react-native-template hit exactly that and it took a token-length probe in CI to identify. Checking the length up front turns it into an error message that says what to run. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All three CI jobs authenticate to GitHub Packages by echoing the token into
~/.npmrc. That works today and stops working the day this repo moves to pnpm 11 — silently, and with an error that points at the wrong thing.Found while upgrading the sibling
react-native-templateto pnpm 11, where it cost about an hour to diagnose.What breaks
pnpm 11 keeps its own credential store and sends tokens only from there. A token in
~/.npmrcis still read and echoed back in pnpm's own diagnostics:…while never reaching the request, which fails as:
So pnpm reports the credential as present and configured, and the registry reports it as absent. That reads like a revoked token, not a config format change, which is the expensive part.
pnpm config setwrites wherever the running pnpm actually reads, so it is correct on 9 and on 11.The empty-secret guard
The same 401 appears when the secret exists but holds nothing, and the registry error names neither the secret nor the repository.
react-native-templatehad exactly that —gh secret listshowedNODE_AUTH_TOKENpresent, and it was empty. Identifying it needed a temporary step logging the token's length in CI.This adds a length check that fails with the command to fix it:
Length only — never the value.
Note on this repo's secret
CI last passed on 2026-09-01. The account's GitHub token was rotated on 2026-09-04, so if this repo's
NODE_AUTH_TOKENheld the old one, this PR's run is the first to find out. If it fails on the 401 rather than the guard, the secret needs re-setting; the guard only catches an empty value, not a revoked one.Verification
pnpm config set <key> <value>is present in pnpm 9.15.0 (this repo's pinned version) and 11.25.0. No behaviour changes beyond where the credential is written, and the same three jobs run unchanged.🤖 Generated with Claude Code