NPM: Use env var for OIDC token auth instead of direct npmrc (#115153)

* use env var * ignore spellcheck
2025-12-12 07:45:04 +01:00
parent b407f0062d
commit c3224411c0
1 changed files with 5 additions and 2 deletions
@@ -100,8 +100,11 @@ if (( CHANGES_COUNT > 0 )); then
                    if [ -n "$NPM_AUTH_TOKEN" ]; then
                        # Mask the token so it won't appear in logs
                        echo "::add-mask::$NPM_AUTH_TOKEN"
-                        echo "Configuring npm auth token in ~/.npmrc"
-                        echo "//registry.npmjs.org/:_authToken=${NPM_AUTH_TOKEN}" >> ~/.npmrc
+                        echo "Configuring npm auth via NPM_TOKEN env var"
+                        export NPM_TOKEN="$NPM_AUTH_TOKEN"
+                        # Reference the env var in npmrc (single quotes intentional - npm expands it at runtime)
+                        # shellcheck disable=SC2016
+                        echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' >> ~/.npmrc
                    else
                        echo "Warning: No token in response, dist-tag operation may fail"
                    fi