[BUG] v7.3.0 `publish --dry-run` will require login, and `publishConfig` from `package.json` load after the check (ENEEDAUTH)

[dr-js]

Current Behavior:

publish --dry-run with v7.3.0 will require login (ENEEDAUTH)

Expected Behavior:

publish --dry-run should work when not login, like in CI env.

Steps To Reproduce:

mkdir ./test-publish-dry-run/
cd ./test-publish-dry-run/
npm init --yes
npx --yes npm@6 publish --dry-run # will pass
npx --yes npm@7.3.0 publish --dry-run # will error

Sample error log:

# npm publish --dry-run
npm ERR! code ENEEDAUTH
npm ERR! need auth This command requires you to be logged in.
npm ERR! need auth You need to authorize this machine using `npm adduser`

npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2020-12-24T16_00_58_505Z-debug.log

Environment:

• OS: Ubuntu 18.04
• Node: 14.15.3
• npm: 7.3.0

[foxxyz]

Can confirm this is happening on my end also.

Additionally, publishConfig settings in package.json no longer seem to be respected. I have a publishConfig with a custom registry set and npm publish seems to be checking my public npm registry auth and failing instead of looking at my private registry.

npm publish --registry myregistry works as a workaround.

Environment

• OS: MacOS Big Sur
• Node: 15.5.0
• npm: 7.3.0

[foxxyz]

Upon further inspection, this seems related to #2360 and changes in be4a090.

In lib/publish.js, the new registry auth check seems to be being done too early in publish() , as the checks for dry-run and publishConfig option merges don't occur until _publish().

[justinGML]

Thanks @foxxyz, that workaround worked for me too. I experienced this issue when attempting to deploy to a GitLab private repo. I would imagine this would break the build pipeline for anyone else following the example configuration in the GitLab docs: https://docs.gitlab.com/ee/user/packages/npm_registry/#publish-an-npm-package-by-using-cicd

[thw0rted]

I don't want to sidetrack this issue too much but if dry-run doesn't try to log in at all, what should I use to test that my stored credential works (without actually publishing a package)?

[dr-js]

@thw0rted try npm whoami?

[thw0rted]

Nice! Thanks, I just learned about the command today but didn't realize it was actually making a network request. Adding a --verbose flag shows the request URL and response status.

One caveat is that whoami works against the resolved registry value without touching publishConfig, I guess because you might need auth for the "get" registry (i.e. for npm install). I was thinking it'd be nice if whoami had a flag to run in "publish mode", something like npm whoami --publish, which would avoid having to dig around in your package file to find the URL to pass to --registry.