$ show semantic-release/npm
This repository is a semantic-release plugin that automates the publishing of npm packages. It implements four lifecycle steps: verifyConditions (validates configuration and authentication), prepare (updates package.json version and optionally creates a tarball), publish (publishes the package to the npm registry), and addChannel (adds a release to a dist-tag). The plugin supports both token-based authentication (via NPM_TOKEN) and OIDC-based trusted publishing for GitHub Actions, GitLab Pipelines, and CircleCI. It can publish to custom registries, handle scoped packages, and skip publishing for private packages or when npmPublish is false. The architecture is a set of exported async functions that receive pluginConfig and context from semantic-release, delegating to internal lib modules. External dependencies include the npm CLI (executed via execa), fs-extra for file operations, registry-auth-token for authentication, env-ci for CI provider detection, and @actions/core for OIDC token retrieval. The codebase is well-structured with clear separation of concerns, comprehensive error handling using AggregateError, and extensive test coverage with both unit and integration tests.
The LLM identified 2 files worth highlighting for reuse:
This module handles the setup of npm authentication by merging existing .npmrc configurations (from home and project directories) and injecting the NPM_TOKEN environment variable. It uses the 'rc' library to parse npm config, reads existing config files, and writes a temporary .npmrc file with the token. If authentication is already configured in an .npmrc file, it preserves that configuration. This is a self-contained utility that could be reused in any npm-related tool requiring authentication setup, demonstrating a clean pattern for config merging and token injection.
This module implements OIDC token exchange for trusted publishing across multiple CI providers (GitHub Actions, GitLab Pipelines, CircleCI). It uses env-ci to detect the current CI provider and then performs the appropriate token exchange: for GitHub Actions it uses @actions/core's getIDToken, for GitLab and CircleCI it reads the NPM_ID_TOKEN environment variable. The token is then exchanged with the npm registry via a POST request to the OIDC token exchange endpoint. This is a well-isolated module that abstracts provider-specific logic behind a single function, making it reusable for any npm publishing tool that wants to support trusted publishing.