Repository navigation
[build-tools][worker] keep NPM_TOKEN working on newer pnpm and explain pnpm Node.js mismatches - #4729
Merged
hSATAC merged 1 commit intoOct 28, 2026
Conversation
hSATAC
marked this pull request as ready for review
October 23, 2026 12:21
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4729 +/- ##
==========================================
+ Coverage 75.75% 75.79% +0.05%
==========================================
Files 1061 1063 +2
Lines 52824 52855 +31
Branches 11564 11567 +3
==========================================
+ Hits 40011 40058 +47
+ Misses 11833 11818 -15
+ Partials 980 979 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
| { | ||
| // example log: "warn: This version of pnpm requires at least Node.js v22.13" followed by "warn: The current version of Node.js is v20.19.4" | ||
| regexp: | ||
| /This version of pnpm requires at least Node\.js v([\d.]+)\n.*The current version of Node\.js is v([\d.]+)/, |
Contributor
There was a problem hiding this comment.
It could be useful to show this message in installPnpm() too, for users who set their pnpm version in eas.json
| const projectNpmrcPath = path.join(ctx.buildDirectory, '.npmrc'); | ||
| async function addNpmTokenToHomeNpmrcAsync(logger: bunyan): Promise<void> { | ||
| logger.info(`Adding "${NpmrcAuthTokenLine}" to ~/.npmrc`); | ||
| await fs.appendFile(path.join(os.homedir(), '.npmrc'), `\n${NpmrcAuthTokenLine}\n`); |
Contributor
There was a problem hiding this comment.
If NPM_CONFIG_USERCONFIG is set, I believe the token needs to go in that file instead of ~/.npmrc
AbbanMustafa
approved these changes
Oct 28, 2026
hSATAC
changed the title
hSATAC
force-pushed
the
ash/eng-28287-newer-pnpm-breaks-two-eas-build-defaults-npm_token-in-the
branch
from
October 28, 2026 08:59
727d989 to
5ee1232
Compare
Base automatically changed from
ash/eng-28285-easrepack-installs-exporepack-app-with-a-hard-coded-yarn-add
to
main
October 28, 2026 09:10
…n pnpm Node.js mismatches
pnpm 10.34.2+ and 11.5.3+ ignore ${NPM_TOKEN} placeholders in a project-level .npmrc (GHSA-3qhv-2rgh-x77r) but still expand them in the npm user config. On EAS Build the NPM_TOKEN credential now goes into the file `npm config get userconfig` reports for the build env (~/.npmrc unless NPM_CONFIG_USERCONFIG points elsewhere) whenever the job has NPM_TOKEN, and the project .npmrc is left to the user. Local builds keep creating the project .npmrc, because the home directory there belongs to the developer. The legacy PREPARE_PROJECT path and the eas/use_npm_token step share one helper.
Projects that pin pnpm 11 through packageManager on a Node 20 image crash on node:sqlite right after pnpm's "requires at least Node.js v22.13" banner. A new user error names the eas.json node value to set or the pnpm version to change. The worker raises the same error when it reinstalls pnpm under a node version pinned in eas.json, instead of the generic "Failed to install pnpm" message: the typed error it threw before never reached the log handlers, and the probe's piped output never reached the log.
hSATAC
force-pushed
the
ash/eng-28287-newer-pnpm-breaks-two-eas-build-defaults-npm_token-in-the
branch
from
October 28, 2026 09:10
5ee1232 to
92cd573
Compare
|
✅ Thank you for adding a changeset! |
hSATAC
deleted the
ash/eng-28287-newer-pnpm-breaks-two-eas-build-defaults-npm_token-in-the
branch
October 28, 2026 09:19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
pnpm 10.34.2+ and 11.5.3+ ignore
${NPM_TOKEN}in a project-level.npmrc, so the file EAS Build generates forNPM_TOKENno longer authenticates private installs on the default images. Projects that pin pnpm 11 on a Node 20 image also crash onnode:sqlitewithout the build error saying why.How
//registry.npmjs.org/:_authToken=${NPM_TOKEN}to the builder's npm user config on EAS Build, where every package manager still expands it, and leave the project.npmrcto the user. The file is whatevernpm config get userconfigreports for the build env (~/.npmrcunlessNPM_CONFIG_USERCONFIGpoints elsewhere), so npm applies its own path rules..npmrcon local builds.setUpNpmrcAsyncbetween the legacy prepare-project path and theeas/use_npm_tokenstep.nodevalue to set.nodepinned in eas.json, instead of the generic "Failed to install pnpm" message.Stacked on #4728, which removes the only env-less Yarn 1 spawn that would abort on the placeholder.
Test Plan
Added unit coverage for the
~/.npmrcappend on EAS Build, theNPM_CONFIG_USERCONFIGoverride, the project.npmrcon local builds, the new error handler, and the worker's pnpm reinstall failure. Also verified against a local registry that pnpm 10.34.7 / 11.9.0 / 11.28.6 / 12.15.0, npm, Yarn 1 and bun expand the user-level placeholder and that a project-level entry wins, and ran lint, TypeScript checks and the changeset validation.