panates / rman / 36482155520

95%

main: 95%

push

github

ci: print what decides npm auth, before the publish that needs it

The first real release failed with

  npm error code ENEEDAUTH
  npm error need auth This command requires you to be logged in to https://registry.npmjs.org/

which has two possible causes needing different fixes, and one message for both.
npm Trusted Publishing exchanges a GitHub OIDC token for a short-lived npm one
before publishing, and attempts that only when it is running in a supported CI,
the id-token permission reached the job, and npm is new enough (>= 11.5.1). Miss
any one and npm falls back to looking for a token it does not have.

  npm too old, or the OIDC vars absent -> the cause is the workflow
  both fine                            -> the cause is the trusted-publisher
                                          connection on npm, whose org, repo,
                                          workflow filename and environment must
                                          match exactly

Three things were ruled out before adding this, so the step is aimed rather than
a fishing expedition:

- rman does pass the environment to its child. `BinPath.env` starts from
  `{ ...process.env }`, so ACTIONS_ID_TOKEN_REQUEST_URL/TOKEN are inherited.
- no `npm` sits in any `node_modules/.bin` here, so nothing shadows the global
  one that `npm install -g npm@latest` upgrades.
- the job does carry `id-token: write`, and no NPM_TOKEN is set, so OIDC is the
  only route it could have taken.

The step prints the candidate *directories* rather than running a child's
`npm --version`: `BinPath` puts every `node_modules/.bin` from the package
upward plus the running node's own directory ahead of the inherited PATH, so an
npm in any of those is what publishes - and listing them is deterministic, where
asking rman to exec it is not (`exec` runs per package, and `--scope /` selects
nothing there, the repository's package list holding the members only).

Not conditional: the run that needs it is the on... (continued)

2888 of 3170 branches covered (91.1%)

Branch coverage included in aggregate %.

17348 of 18328 relevant lines covered (94.65%)

195.33 hits per line