GitLab registry gives error when publishing on master-branch to latest tag

[boy51]

Hi,

I am on a self-hosted gitlab. The repository has next and main branch. In my CI, I'm trying to publish to gitlab npm registry. From what I understand, if semantic-release runs on my next branch, it will try to publish to the registry on dist-tag next. Then, if I merge to master, it will publish the version to dist-tag latest.

Now my problem is, everything works fine on my next branch. However, when I merge to master, semantic release gives me the error:

[...]
[2:59:33 PM] [semantic-release] › ℹ  Found 7 commits since last release
[2:59:33 PM] [semantic-release] › ℹ  Start step "generateNotes" of plugin "@semantic-release/release-notes-generator"
[2:59:33 PM] [semantic-release] › ✔  Completed step "generateNotes" of plugin "@semantic-release/release-notes-generator"
[2:59:34 PM] [semantic-release] › ✔  Add default channel to tag v2.2.0
[2:59:34 PM] [semantic-release] › ℹ  Start step "addChannel" of plugin "@semantic-release/npm"
[2:59:34 PM] [semantic-release] [@semantic-release/npm] › ℹ  Adding version 2.2.0 to npm registry on dist-tag latest
npm ERR! code E401
npm ERR! 401 Unauthorized - GET https://*****/v4/projects/310/packages/npm/-/package/@xxx%2fpackage/dist-tags
npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2021-07-13T14_59_35_246Z-debug.log
[2:59:35 PM] [semantic-release] › ✖  Failed step "addChannel" of plugin "@semantic-release/npm"
[2:59:35 PM] [semantic-release] › ✖  An error occurred while running semantic-release: Error: Command failed with exit code 1: npm dist-tag add @xxx/package@2.2.0 latest --userconfig /tmp/69163fa67e96ebcaf74c092dded34da6/.npmrc --registry https://******/v4/projects/310/packages/npm/
npm ERR! code E401
npm ERR! 401 Unauthorized - GET https://*****/v4/projects/310/packages/npm/-/package/@xxx%2fpackage/dist-tags
npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2021-07-13T14_59_35_246Z-debug.log
    at makeError (/builds/workplace-booking/package/node_modules/execa/lib/error.js:60:11)
    at handlePromise (/builds/workplace-booking/package/node_modules/execa/index.js:118:26)
    at processTicksAndRejections (internal/process/task_queues.js:95:5)
    at async module.exports (/builds/workplace-booking/package/node_modules/@semantic-release/npm/lib/add-channel.js:31:5)
    at async validator (/builds/workplace-booking/package/node_modules/semantic-release/lib/plugins/normalize.js:34:24)
    at async /builds/workplace-booking/package/node_modules/semantic-release/lib/plugins/pipeline.js:37:34
    at async /builds/workplace-booking/package/node_modules/semantic-release/lib/plugins/pipeline.js:31:3
    at async Object.pluginsConf.<computed> [as addChannel] (/builds/workplace-booking/package/node_modules/semantic-release/lib/plugins/index.js:80:11)
    at async run (/builds/workplace-booking/package/node_modules/semantic-release/index.js:132:24)
    at async module.exports (/builds/workplace-booking/package/node_modules/semantic-release/index.js:260:22) {
  shortMessage: 'Command failed with exit code 1: npm dist-tag add @xxx/package@2.2.0 latest --userconfig /tmp/69163fa67e96ebcaf74c092dded34da6/.npmrc --registry https://******v4/projects/310/packages/npm/',
  command: 'npm dist-tag add @xxx/package@2.2.0 latest --userconfig /tmp/69163fa67e96ebcaf74c092dded34da6/.npmrc --registry https://******/v4/projects/310/packages/npm/',
  escapedCommand: 'npm dist-tag add "@xxx/package@2.2.0" latest --userconfig "/tmp/69163fa67e96ebcaf74c092dded34da6/.npmrc" --registry "https://******/v4/projects/310/packages/npm/"',
  exitCode: 1,
  signal: undefined,
  signalDescription: undefined,
  stdout: '',
  stderr: 'npm ERR! code E401\n' +
    'npm ERR! 401 Unauthorized - GET https://******/v4/projects/310/packages/npm/-/package/@xxx%2fpackage/dist-tags\n' +
    '\n' +
    'npm ERR! A complete log of this run can be found in:\n' +
    'npm ERR!     /root/.npm/_logs/2021-07-13T14_59_35_246Z-debug.log',
  failed: true,
  timedOut: false,
  isCanceled: false,
  killed: false,
  pluginName: '@semantic-release/npm'
}
Error: Command failed with exit code 1: npm dist-tag add @xxx/package@2.2.0 latest --userconfig /tmp/69163fa67e96ebcaf74c092dded34da6/.npmrc --registry https://*******/v4/projects/310/packages/npm/
npm ERR! code E401
npm ERR! 401 Unauthorized - GET https://******/v4/projects/310/packages/npm/-/package/@xxx%2fpackage/dist-tags
npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2021-07-13T14_59_35_246Z-debug.log
    at makeError (/builds/workplace-booking/package/node_modules/execa/lib/error.js:60:11)
    at handlePromise (/builds/workplace-booking/package/node_modules/execa/index.js:118:26)
    at processTicksAndRejections (internal/process/task_queues.js:95:5)
    at async module.exports (/builds/workplace-booking/package/node_modules/@semantic-release/npm/lib/add-channel.js:31:5)
    at async validator (/builds/workplace-booking/package/node_modules/semantic-release/lib/plugins/normalize.js:34:24)
    at async /builds/workplace-booking/package/node_modules/semantic-release/lib/plugins/pipeline.js:37:34
    at async /builds/workplace-booking/package/node_modules/semantic-release/lib/plugins/pipeline.js:31:3
    at async Object.pluginsConf.<computed> [as addChannel] (/builds/workplace-booking/package/node_modules/semantic-release/lib/plugins/index.js:80:11)
    at async run (/builds/workplace-booking/package/node_modules/semantic-release/index.js:132:24)
    at async module.exports (/builds/workplace-booking/package/node_modules/semantic-release/index.js:260:22) {
  shortMessage: 'Command failed with exit code 1: npm dist-tag add @xxx/package@2.2.0 latest --userconfig /tmp/69163fa67e96ebcaf74c092dded34da6/.npmrc --registry https://******/v4/projects/310/packages/npm/',
  command: 'npm dist-tag add @xxx/package@2.2.0 latest --userconfig /tmp/69163fa67e96ebcaf74c092dded34da6/.npmrc --registry https://******/v4/projects/310/packages/npm/',
  escapedCommand: 'npm dist-tag add "@xxx/package@2.2.0" latest --userconfig "/tmp/69163fa67e96ebcaf74c092dded34da6/.npmrc" --registry "https://******/v4/projects/310/packages/npm/"',
  exitCode: 1,
  signal: undefined,
  signalDescription: undefined,
  stdout: '',
  stderr: 'npm ERR! code E401\n' +
    'npm ERR! 401 Unauthorized - GET https://******/v4/projects/310/packages/npm/-/package/@xxx%2fpackage/dist-tags\n' +
    '\n' +
    'npm ERR! A complete log of this run can be found in:\n' +
    'npm ERR!     /root/.npm/_logs/2021-07-13T14_59_35_246Z-debug.log',
  failed: true,
  timedOut: false,
  isCanceled: false,
  killed: false,
  pluginName: '@semantic-release/npm'
}
Cleaning up file based variables
00:01
ERROR: Job failed: exit code 1

Seems like I'm getting a 401 Unauthorized error - but this happens only on master branch. On nextbranch, the same pipeline is running fine.

What I also don't understand is if I check the dist-tags via api (https://******/v4/projects/310/packages/npm/-/package/@xxx%2fpackage/dist-tags), @latest and @next tags have equal versions. So it seems like the pipeline on next is also publishing to latest tag. This makes me believe that the problem is not authentication with gitlab.

My config simply extends "@semantic-release/gitlab-config" with nothing else changed.

I appreciate any help to find the problem.

Thanks for this awesome lib!

[boy51]

Gitlab version is 14.2.3 and @semantic-release/gitlab@6.2.2

[travi]

a clarification that i think is important here: you mentioned your understanding to be

Then, if I merge to master, it will publish the version to dist-tag latest.

instead of "publishing", the latest tag is added to the existing version in that case. it is the same version that was already available, but it is now promoted to the latest channel because of that tag. the following output highlights that detail:

[2:59:34 PM] [semantic-release] › ✔ Add default channel to tag v2.2.0
[2:59:34 PM] [semantic-release] › ℹ Start step "addChannel" of plugin "@semantic-release/npm"
[2:59:34 PM] [semantic-release] [@semantic-release/npm] › ℹ Adding version 2.2.0 to npm registry on dist-tag latest

@latest and @next tags have equal versions. So it seems like the pipeline on next is also publishing to latest tag.

so, after successful promotion, @latest and @next indeed have equal versions. does that clarify this point?

Seems like I'm getting a 401 Unauthorized error - but this happens only on master branch.

can you share some details about the NPM_TOKEN that you are using and whether the registry is the official registry or an internal one? promoting to an additional channel calls a different endpoint, so you may need additional permissions to be granted to your token. i know there was a period where the automation tokens available from the official registry did not support such promotion. if you are using an old automation token against the old registry or you add more permissions to a token for an internal registry, you may need to regenerate the token.

[boy51]

Thanks for the clarification, I was not sure whether it would publish again or just update the tag. But still, I've been running pipelines in that repo only on next for a while, so I expect @latest to be behind @next quite a bit, but if I check the endpoint, the versions are equal, leading me to believe that my next is also publishing the @latest tag.

I'm trying to publish to the self-hosted gitlab's internal registry via the project endpoint.

"publishConfig": {
    "@xxx:registry": "https://*******/v4/projects/310/packages/npm/"
  },

In Gitlab CI I set the NPM_TOKEN to CI_JOB_TOKEN, which is what they recommend in gitlab docs. Actually now that I'm looking at the docs I saw this note

The token inherits the permissions of the user that generates the pipeline.

Maybe I actually don't have the permissions to publish to latest tag in the registry?

variables:
  NPM_TOKEN: ${CI_JOB_TOKEN}
  GITLAB_TOKEN: ${GITLAB_PRIVATE_TOKEN}

I guess I'll try to use the private token as npm token.

[SimonChaumet]

Did you find how to solve it without generating a personal token ?