I was not aware of this syntax @USERNAME:registry and thus it might not be handled correctly - neither when we read the information from .npmrc and neither when we interpret package.json#publishConfig.

However, even despite those configurations, it seems that your package is being published to the default registry - perhaps because you specify it as the registry-url input to the actions/setup-node. Maybe this somehow leads to incorrect calls being made and to a confusing error.

However, this is still quite confusing because this package indeed exists in the queried registry. I'm not exactly sure what happens here.

A sideways question - are you sure that you actually want to publish this package to the GitHub Packages registry and not to the NPM registry?

I didn't know that @USERNAME:registry and package.json#publishConfig are for GitHub packages and that was my mistake.

I removed them and added the following but it returns the same error:

- name: Creating .npmrc
        run: |
          cat << EOF > "$HOME/.npmrc"
            //registry.npmjs.org/:_authToken=$NPM_TOKEN
          EOF
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

I still don't understand why this error happens to you but one thing I've noticed is that you are outputting all build artifacts into another directory.

When doing so you probably should use this:

"publishConfig": {
  "dir": "./package"
}

Yes, Sveltekit requires svelte-package and outputs all to ./package.

Thanks. I will try it.

When i use standard-version, this is what I do:

standard-version && git push --follow-tags origin main && npm run package && cd package && npm publish && cd ..

• standard-version: bump the version and update the Changelog according to the commit messages.
• git push --follow-tags origin main: put to the github repo
• npm run package: create a package
• cd package: change dir to package
• npm publish: publish to NPM
• cd ..: return to the root dir.

any updates here? I am having the same error

@0xmaayan this error most likely means that your .npmrc is misconfigured. I can't give you more concrete advice on how to fix this if you don't share a repro case.

@Andarist thanks!
I am using a github workflow to publish packages that haven't created yet (i.e not on npmjs).

This is my .yaml workflow setup

name: Release

on:
  push:
    branches:
      - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [16.x]

    steps:
      - name: Checkout Repo
        uses: actions/checkout@v3

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v3
        with:
          node-version: ${{ matrix.node-version }}

      - uses: pnpm/action-setup@v2
        name: Install pnpm
        id: pnpm-install
        with:
          version: 7
          run_install: false

      - name: Install Dependencies
        run: pnpm install --frozen-lockfile

      - name: Build global project
        run: pnpm run build

      - name: Create Release Pull Request or Publish to npm
        uses: changesets/action@v1
        with:
          publish: pnpm run publish-packages // runs changeset version && changeset publish
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

It creates a PR but then when merging it and trying to publish, it fails.
I tried with creating a .npmrc file action and without it - both output the same error.

I noticed that it fails for scoped packages (i.e @<org>/<name> format).

Fails for my scoped packages too

@Andarist hey can you have a look at this? The problem is that changeset publish fails for scoped packages.
You can use this repo to see logs about.

Some solution for this?

changesets/action#246 (comment)

Hope this helps someone. I tried everything above (except for ticking off the 2 factor auth) and the following worked for me:

1. Classic NPM token with write access
2. Environment secret in workflow with the value of the token that has NPM write access, say NPM_READWRITE_TOKEN, but you can name it as you wish
3. Replaced NPM_TOKEN with NODE_AUTH_TOKEN

- name: Publish to npm
        id: changesets
        uses: changesets/action@v1
        with:
          version: npm run version
          # This expects you to have a script called release which does a build for your packages and calls changeset publish
          publish: npm run publish-packages
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{secrets.NPM_READWRITE_TOKEN}}

I didn't need a .npmrc file or a script to generate it

Result:

I had the same issue, but only using the action. When locally running the npx changeset publish it worked for me (using an env variable set in .zshrc).

I do have an .npmrc file, because I have some additional settings. It turned out that I was using a custom env variable name for the npm token that didn't match the default action (NPM_TOKEN). Maybe this helps:

part of the workflow file:

- name: Create release pull request or publish to npm
        id: changesets
        uses: changesets/action@v1
        with:
          publish: pnpm release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          YOUR_NPM_TOKEN: ${{ secrets.NPM_AUTOMATION_TOKEN }}

• secrets.GITHUB_TOKEN is a token set by github. You don't need to provide it.
• secrets.NPM_AUTOMATION_TOKEN is set in https://github.com/<user>/<repo>/settings/secrets/actions
• YOUR_NPM_VAR needs to be referenced in .npmrc

.npmrc:

//registry.npmjs.org/:_authToken=${YOUR_NPM_TOKEN}

Note that there's no process.env. in front of YOUR_NPM_TOKEN.

I have set up a changeset in my scoped mono repository and encountered an issue similar to the one described above. You can check my workflow here.

I spent a significant amount of time debugging, as I mistakenly assumed the documentation was using the correct environment variable name. However, the solution was quite simple: I just needed to change the reference for the environment variable as follows:

NPM_TOKEN -> NODE_AUTH_TOKEN

You can see the change here

I would like to suggest updating the following changes to the project docs on the following PR: changesets/action#428

I'd like to give special thanks to @canberksinangil for his repository, which helped me realize what changes were needed to make it work for the npm-publish.yml.

Additional context (edited original comment 04/12/2024)

I wanted to add some background to this PR to provide better context for the reviewers to assist with the approval. The environment variable is defined by how NodeJS is set up within the GitHub Action Setup-node, which will automatically create a .npmrc file using this as an environment variable.

Therefore, the action expects us to use this variable over others, while if you decide to create your own .npmrc, we will be in control. As we can see on here. Hence the documentation was updated to align with the previous steps above to align with the setup-node specifications mitigating potential issues when developer use the code given in the Readme

For me check actions/setup-node@v4 without registry-url
with registry-url use NODE_AUTH_TOKEN or use NPM_TOKEN

# Optional registry to set up for auth. Will set the registry in a project level .npmrc and .yarnrc file,
# and set up auth to read in from env.NODE_AUTH_TOKEN.
# Default: ''
registry-url: ''

refer https://github.com/actions/setup-node/tree/v4/?tab=readme-ov-file#usage