pnpm publish always publishes the created tarball

[RafidMuhymin]

pnpm version: 6.32.8

Code to reproduce the issue: pnpm publish

Expected behavior: pnpm publish shouldn't publish the created tarball

Actual behavior: pnpm publish is publishing the created tarball

Additional information:

• node -v prints: 17.6.0
• Windows, macOS, or Linux?: Linux

[fireairforce]

can u please provide a more detailed demo ?

[RafidMuhymin]

Thanks for your response @fireairforce ! The package I'm trying to publish is astro-imagetools and its code is at https://github.com/RafidMuhymin/astro-imagetools/tree/main/packages/astro-imagetools/. Whenever I'm publishing a new version using pnpm publish, the created tarball is also getting published.

For example, check this links https://unpkg.com/astro-imagetools@0.5.3/astro-imagetools-0.5.3.tgz https://unpkg.com/astro-imagetools@0.5.4/astro-imagetools-0.5.4.tgz and https://unpkg.com/astro-imagetools@0.5.5/astro-imagetools-0.5.5.tgz.

The command is acting like it's equivalent to pnpm pack && npm publish

[zkochan]

The root cause of this issue might be the same as the cause of this one: #4348

[zkochan]

pnpm packs the tarball and then it runs npm CLI to publish the tarball:

pnpm/packages/plugin-commands-publishing/src/publish.ts

Lines 199 to 201 in 9f06162

	const { status } = runNpm(opts.npmPath, ['publish', '--ignore-scripts', path.basename(tarballName), ...args], {
	cwd: tarballDir,
	})

Maybe this doesn't work in the latest npm? Although I could not reproduce the issue while looking into #4348

[zkochan]

I believe this is fixed by #4627