fix: respect project .npmrc without requiring registry-url

[fengmk2]

Summary

When the workflow doesn't pass registry-url, honor the project .npmrc and make NODE_AUTH_TOKEN "just work" — so the repo's .npmrc can stay minimal and the workflow doesn't have to duplicate registry config.

Three things happen in the no-registry-url branch:

1. Auto-generate _authToken for declared registries. If NODE_AUTH_TOKEN is set in env and the project .npmrc declares a registry (e.g. @myorg:registry=https://npm.pkg.github.com) without a matching _authToken entry, write //<host>/:_authToken=${NODE_AUTH_TOKEN} to $RUNNER_TEMP/.npmrc and point NPM_CONFIG_USERCONFIG at it. This mirrors the setup-node + pnpm/action-setup experience without requiring registry-url in the workflow.
2. Respect existing _authToken entries. If the repo .npmrc already has an _authToken line for that registry (case-insensitive), it's left alone — no supplemental file is written.
3. Propagate ${VAR} references via GITHUB_ENV. Any env vars referenced in the project .npmrc (e.g. ${NODE_AUTH_TOKEN}, ${NPM_TOKEN}) that are set in process.env are re-exported so they persist to the vp install subprocess and subsequent steps. Runner-managed namespaces (RUNNER_*, GITHUB_*) are blocked by prefix with GITHUB_TOKEN on an explicit allowlist, so a .npmrc referencing ${GITHUB_REF} or similar can't clobber runner-provided values for downstream steps.

Registry values containing ${VAR} (e.g. registry=${CUSTOM_REGISTRY}) are skipped for auth-key synthesis — npm/pnpm don't expand env vars inside .npmrc keys, so the synthesized _authToken line would be unreachable. The referenced var is still collected for env propagation.

The existing registry-url path is unchanged.

Minimal config after this PR

# .npmrc in the repo — auth line not required, action adds it:
#   @myorg:registry=https://npm.pkg.github.com

steps:
  - uses: actions/checkout@v6
  - uses: voidzero-dev/setup-vp@v1
    with:
      node-version: "lts"
    env:
      NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Before this PR, the workflow above would fail without also passing registry-url: https://npm.pkg.github.com, duplicating config the repo already has.

Implementation notes

• All logic lives in src/auth.ts, next to the existing registry-url writer
• Shared primitives: getRunnerNpmrcPath, stripProtocol, authKeyFor, buildAuthLine, NODE_AUTH_TOKEN_REF, readNpmrc — both write paths use them so URL/auth-line handling is in one place
• readNpmrc uses try/catch on ENOENT (no existsSync + readFileSync TOCTOU)
• On re-runs, if $RUNNER_TEMP/.npmrc already matches the target content, the write is skipped and the log is downgraded to debug
• isReservedEnvVar uses prefix-based blocking (RUNNER_*, GITHUB_*) with an allowlist for GITHUB_TOKEN

Closes #50

Test plan

• 18 unit tests for propagateProjectNpmrcAuth in src/auth.test.ts cover:
  • auto-writing _authToken for scoped + default registries
  • respecting existing _authToken lines (case-insensitive)
  • not writing when NODE_AUTH_TOKEN is unset
  • multiple missing registries in one project .npmrc
  • preserving unrelated lines already in $RUNNER_TEMP/.npmrc
  • replacing stale _authToken entries for the same registry
  • no-op re-run (skipped write)
  • skipping registries whose value contains ${VAR}
  • blocking runner-managed RUNNER_* / GITHUB_* vars, allowing GITHUB_TOKEN
  • propagation of ${VAR} env vars, skipping reserved system vars and unset vars, deduping repeats
  • ENOENT vs other read errors
• vp run test — 115 tests pass
• vp run typecheck — clean
• vp run check:fix — clean
• vp run build — dist/index.mjs rebuilt
• Existing CI test-registry-url job continues to pass (unchanged path)
• Manual verification in a workflow with repo .npmrc (registry line only) + NODE_AUTH_TOKEN, no registry-url

[Copilot]

Pull request overview

Updates setup-vp to respect an in-repo .npmrc when registry-url is not provided, so auth env vars referenced by .npmrc can be propagated in a way that remains visible to installs and later workflow steps.

Changes:

• Added .npmrc detection + ${VAR} reference extraction, and propagation of referenced env vars via @actions/core.exportVariable.
• Wired the new propagation path into the main action flow when registry-url is absent (leaving the existing registry-url behavior unchanged).
• Added unit tests for detection/propagation and updated README guidance; rebuilt dist/index.mjs.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/npmrc-detect.ts	Implements project .npmrc detection and env-var propagation.
src/npmrc-detect.test.ts	Adds unit tests covering detection and propagation behavior.
src/index.ts	Integrates .npmrc propagation when registry-url isn’t set.
dist/index.mjs	Rebuilt compiled action output including the new behavior.
README.md	Documents .npmrc-based auth as the default path and registry-url as fallback.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[fengmk2]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b776fb5. Configure here.}

[fengmk2]

@cursor review

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f61ca9e. Configure here.}