Override .npmrc?

I’ve created create-react-app/react-scripts tools which I’m now trying to create a workflow for to validate the scripts as a PR gate. As a quick summary the “create” tool will set up an application and then there are a series of “scripts” commands which can be run against the application to eg. test, lint, build, start. The “create” operation contains two parts: it scaffolds an application from a template and then runs npm install in that directory to install dependencies.

The problem I’ve run into is that the second part of the “create” operation (installing dependency) requires an authenticated (to Github Package Registry) npm session. This is typically done locally via npm login, but my challenge is having to do this in the middle of the “create” module. The challenge is that the second part of the “create” operation (running npm install) will use an .npmrc file which is created in the first part of the “create” operation so it doesn’t exist when that step of my workflow is kicked off. So how do I authorize the npm session needed for the npm install part of the “create” operation?

A workaround I have is to add to my “create” command the ability to skip the second npm install step. I will skip it in my workflow, then authorize the .npmrc file created in the “create” command, then run npm install as a final, manual step.

This is how I authorize the .npmrc file by the way:

- name: Authorize npm
  run: echo -e "\n//npm.pkg.github.com/:_authToken=\"$NODE_AUTH_TOKEN\"" >> $GITHUB_WORKSPACE/$APP_NAME/.npmrc

This works, but it results in my workflow not validating my tools exactly as they are used by consumers.

I’m new to Github Actions, but I believe there is an .npmrc file that lives in $GITHUB_WORKSPACE (~/.npmrc) which a workflow will use if another .npmrc file does not exist. I’m wondering if there is a way to define a workflow step, telling it what .npmrc file to use for the entirety of that step. This would effectively allow me to override the .npmrc file used during my “create” step.

Something like this:

- name: Create app
  run: |
    echo -e "\n//npm.pkg.github.com/:_authToken=\"$NODE_AUTH_TOKEN\"" >> $GITHUB_WORKSPACE/.npmrc
    npm run my-create-tool
  with:
    npmrc: $GITHUB_WORKSPACE/.npmrc    

Is something like that possible?

It might be possible to make npm not check the default locations using the configuration options userconfig and globalconfig:

In your workflow, I imagine something like this, using environment variables:

- name: Create app
  env:
    npm_config_userconfig: '/path/to/your/.npmrc'
    npm_config_globalconfig: '/path/to/your/.npmrc'
  run: |
    ....