fix: use protocol-relative auth key, mask token, and drop shell spawning

Signed-off-by: pacoorozco <pakus@pakusland.net>

Author: pacoorozco

action.yml

@@ -105,15 +105,15 @@ inputs:
     default: 'true'
   registry-url:
     description: |
-      Base URL of a private npm registry to authenticate against, e.g.
-      `https://myorg.jfrog.io/artifactory/api/npm/npm-local/`. When set,
-      `registry-token` must also be provided. The action runs
-      `pnpm config set "<url>//:_authToken" "<token>"` before installing.
+      Base URL of a private npm registry to authenticate against before
+      installing, e.g. `https://myorg.jfrog.io/artifactory/api/npm/npm-local/`.
+      Requires `registry-token` to also be set.
     required: false
   registry-token:
     description: |
       Auth token for the private registry specified in `registry-url`.
       Pass this via a GitHub secret — it will not appear in logs.
+      Requires `registry-url` to also be set.
     required: false
   token:
     description: >

dist/index.js

@@ -1,4 +1,4 @@
-import { info, setFailed, startGroup, endGroup } from '@actions/core'
+import { info, setFailed, setSecret, startGroup, endGroup } from '@actions/core'
 import { spawnSync } from 'child_process'
 import { existsSync } from 'fs'
 import path from 'path'
@@ -50,17 +50,17 @@ export function runPnpmInstall(inputs: Inputs, runtimeInstalled = Boolean(inputs
   }
 
   if (inputs.registry) {
+    setSecret(inputs.registry.registryToken)
     const configArgs = buildRegistryAuthArgs(inputs.registry.registryUrl, inputs.registry.registryToken)
-    const configCommand = `pnpm ${configArgs.join(' ')}`
-    startGroup(`Running ${configCommand}...`)
-    const configResult = spawnSync('pnpm', configArgs, { stdio: 'inherit', shell: true })
+    startGroup('Configuring private registry auth...')
+    const configResult = spawnSync('pnpm', configArgs, { stdio: 'inherit' })
     endGroup()
     if (configResult.error) {
       setFailed(configResult.error)
       return
     }
     if (configResult.status !== 0) {
-      setFailed(`${configCommand} exited with status ${configResult.status}`)
+      setFailed(`pnpm config set for private registry exited with status ${configResult.status}`)
       return
     }
   }

src/pnpm-install/index.ts

@@ -3,13 +3,18 @@ import assert from 'node:assert/strict'
 import { buildRegistryAuthArgs } from './registry.ts'
 
 describe('buildRegistryAuthArgs', () => {
-  it('returns config set args for the given registry and token', () => {
+  it('uses protocol-relative key form with trailing slash', () => {
     const args = buildRegistryAuthArgs('https://example.jfrog.io/npm/', 'mytoken')
-    assert.deepEqual(args, ['config', 'set', 'https://example.jfrog.io/npm//:_authToken', 'mytoken'])
+    assert.deepEqual(args, ['config', 'set', '//example.jfrog.io/npm/:_authToken', 'mytoken'])
   })
 
-  it('appends trailing slash to registry URL if missing', () => {
+  it('normalises missing trailing slash on the path', () => {
     const args = buildRegistryAuthArgs('https://example.jfrog.io/npm', 'mytoken')
-    assert.deepEqual(args, ['config', 'set', 'https://example.jfrog.io/npm//:_authToken', 'mytoken'])
+    assert.deepEqual(args, ['config', 'set', '//example.jfrog.io/npm/:_authToken', 'mytoken'])
+  })
+
+  it('works with a bare hostname registry', () => {
+    const args = buildRegistryAuthArgs('https://registry.example.com/', 'tok')
+    assert.deepEqual(args, ['config', 'set', '//registry.example.com/:_authToken', 'tok'])
   })
 })

src/pnpm-install/registry.test.mjs

@@ -1,4 +1,6 @@
 export function buildRegistryAuthArgs(registryUrl: string, registryToken: string): string[] {
-  const url = registryUrl.endsWith('/') ? registryUrl : `${registryUrl}/`
-  return ['config', 'set', `${url}/:_authToken`, registryToken]
+  const parsed = new URL(registryUrl)
+  const path = parsed.pathname.endsWith('/') ? parsed.pathname : `${parsed.pathname}/`
+  const key = `//${parsed.host}${path}:_authToken`
+  return ['config', 'set', key, registryToken]
 }