fix: improve npm token extraction with multiple locations and fallbacks

Author: strausr

.github/workflows/release.yml

@@ -101,52 +101,83 @@ jobs:
         run: |
           echo "=== Extracting npm token ==="
           echo "NPM_CONFIG_USERCONFIG: $NPM_CONFIG_USERCONFIG"
+          echo "NODE_AUTH_TOKEN is set: $([ -n "$NODE_AUTH_TOKEN" ] && echo 'yes' || echo 'no')"
           
-          # Copy .npmrc to home directory first
+          # Copy .npmrc to multiple locations
           if [ -f "$NPM_CONFIG_USERCONFIG" ]; then
+            # Copy to home directory
             mkdir -p ~/.npm
             cp "$NPM_CONFIG_USERCONFIG" ~/.npmrc
             echo "✓ Copied .npmrc to ~/.npmrc"
             
+            # Also copy to repository root (semantic-release might look there)
+            cp "$NPM_CONFIG_USERCONFIG" .npmrc
+            echo "✓ Copied .npmrc to repository root"
+            
             # Show .npmrc format (masked) for debugging
+            echo ""
             echo "Contents of .npmrc (masked):"
             cat ~/.npmrc | sed 's/=.*/=***/' || true
             echo ""
             
-            # Extract token - the format should be: //registry.npmjs.org/:_authToken=TOKEN
-            NPM_TOKEN=$(awk -F'=' '/_authToken/ {print $2}' ~/.npmrc | head -1 | tr -d '\n' || echo "")
+            # Extract token - try multiple methods
+            NPM_TOKEN=""
+            
+            # Method 1: awk
+            NPM_TOKEN=$(awk -F'=' '/_authToken/ {print $2}' ~/.npmrc | head -1 | tr -d '\n\r' || echo "")
             
-            # If that didn't work, try grep
+            # Method 2: grep with regex
             if [ -z "$NPM_TOKEN" ]; then
-              NPM_TOKEN=$(grep -oP '(?<=_authToken=).*' ~/.npmrc | head -1 | tr -d '\n' || echo "")
+              NPM_TOKEN=$(grep -oP '(?<=_authToken=).*' ~/.npmrc | head -1 | tr -d '\n\r' || echo "")
             fi
             
-            # If still empty, try without regex (simple sed)
+            # Method 3: simple sed
             if [ -z "$NPM_TOKEN" ]; then
-              NPM_TOKEN=$(grep '_authToken' ~/.npmrc | sed 's/.*_authToken=//' | tr -d '\n' || echo "")
+              NPM_TOKEN=$(grep '_authToken' ~/.npmrc | sed 's/.*_authToken=//' | head -1 | tr -d '\n\r' || echo "")
             fi
             
-            if [ -n "$NPM_TOKEN" ]; then
+            # Method 4: Check if it's a variable reference
+            if [ -z "$NPM_TOKEN" ] || [[ "$NPM_TOKEN" == \$\{*\} ]]; then
+              echo "Token appears to be a variable reference, using NODE_AUTH_TOKEN"
+              if [ -n "$NODE_AUTH_TOKEN" ]; then
+                NPM_TOKEN="$NODE_AUTH_TOKEN"
+              fi
+            fi
+            
+            if [ -n "$NPM_TOKEN" ] && [ "$NPM_TOKEN" != "\${NODE_AUTH_TOKEN}" ]; then
               echo "::add-mask::$NPM_TOKEN"
               echo "NPM_TOKEN=$NPM_TOKEN" >> $GITHUB_ENV
-              echo "✓ NPM_TOKEN extracted and set"
+              echo "✓ NPM_TOKEN extracted and set (length: ${#NPM_TOKEN} chars)"
             else
-              echo "✗ Error: Could not extract token from .npmrc"
-              echo "Full .npmrc content (tokens will be masked in actual output):"
-              cat ~/.npmrc || true
+              echo "✗ Error: Could not extract valid token from .npmrc"
+              echo "Token value: '$NPM_TOKEN'"
+              echo ""
+              echo "Full .npmrc content (first 10 lines, tokens masked):"
+              head -10 ~/.npmrc | sed 's/=.*/=***/' || true
               exit 1
             fi
           else
             echo "✗ Error: .npmrc file not found at $NPM_CONFIG_USERCONFIG"
             echo "This means actions/setup-node did not create the .npmrc file"
-            echo "NODE_AUTH_TOKEN is set: $([ -n "$NODE_AUTH_TOKEN" ] && echo 'yes' || echo 'no')"
-            exit 1
+            echo "Checking if NODE_AUTH_TOKEN can be used directly..."
+            if [ -n "$NODE_AUTH_TOKEN" ]; then
+              echo "::add-mask::$NODE_AUTH_TOKEN"
+              echo "NPM_TOKEN=$NODE_AUTH_TOKEN" >> $GITHUB_ENV
+              echo "✓ Using NODE_AUTH_TOKEN directly as NPM_TOKEN"
+            else
+              exit 1
+            fi
           fi
           
           # Test authentication
           echo ""
           echo "=== Testing npm authentication ==="
-          npm whoami --registry=https://registry.npmjs.org && echo "✓ npm authentication successful" || echo "✗ npm authentication failed"
+          if npm whoami --registry=https://registry.npmjs.org 2>/dev/null; then
+            echo "✓ npm authentication successful"
+          else
+            echo "✗ npm authentication test failed"
+            echo "Note: This might be OK - semantic-release will verify the token"
+          fi
 
       - name: Release
         env: