feat: add support for npm Trusted Publishers with NPM_ID_TOKEN - #227

src/main.ts (1)

69-88: Consider extracting .npmrc handling to reduce cognitive complexity.

The cognitive complexity is slightly above the threshold (16 vs 15). While the code is readable, extracting the .npmrc handling logic into a separate function could improve maintainability.

Example refactor:

async function ensureNpmrc(
  npmrcPath: string,
  NPM_ID_TOKEN: string | undefined,
  NPM_TOKEN: string | undefined
): Promise<void> {
  if (fs.existsSync(npmrcPath)) {
    console.log('Found existing .npmrc file')
  } else if (NPM_ID_TOKEN) {
    console.log(
      'Detected `NPM_ID_TOKEN`; skipping `.npmrc` creation (Trusted Publishers mode).',
    )
  } else if (NPM_TOKEN) {
    console.log('No .npmrc file found, creating one with `NPM_TOKEN`')
    await fs.promises.writeFile(
      npmrcPath,
      `//registry.npmjs.org/:_authToken=${NPM_TOKEN}`,
    )
  } else {
    setFailed(
      'No `.npmrc` found and neither `NPM_TOKEN` nor `NPM_ID_TOKEN` provided, unable to publish packages',
    )
    throw new Error('No npm authentication available')
  }
}

Then in the main function:

try {
  await ensureNpmrc(npmrcPath, NPM_ID_TOKEN, NPM_TOKEN)
} catch {
  return
}

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

src/main.ts (1)

72-85: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add regression coverage for the authentication branch matrix.

Please cover existing .npmrc, NPM_ID_TOKEN precedence, NPM_TOKEN creation, missing-token failure, and both tokens being present.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/main.ts` around lines 72 - 85, Add regression tests for the
authentication branching in the main publishing flow: cover an existing .npmrc,
NPM_ID_TOKEN taking precedence, NPM_TOKEN creating .npmrc, failure when neither
token exists, and the behavior when both tokens are present. Assert the relevant
filesystem writes, logs, and setFailed outcome for each branch.