fix: use tmp for .npmrc creation

package.json

@@ -22,7 +22,7 @@
     "docs": "mkdir -p docs && cp ./README.md ./docs/README.md"
   },
   "dependencies": {
-    "@semrel-extra/topo": "^1.9.0",
+    "@semrel-extra/topo": "^1.9.1",
     "cosmiconfig": "^8.1.3",
     "queuefy": "^1.2.1",
     "zx-extra": "^2.5.4"

src/main/js/npm.js

@@ -1,5 +1,5 @@
 import {log} from './log.js'
-import {$, ctx, fs, path, INI, fetch} from 'zx-extra'
+import {$, fs, INI, fetch, tempy} from 'zx-extra'
 
 export const fetchPkg = async (pkg) => {
   const id = `${pkg.name}@${pkg.version}`
@@ -34,19 +34,20 @@ export const fetchManifest = async (pkg, {nothrow} = {}) => {
   }
 }
 
-export const npmPublish = (pkg) => ctx(async ($) => {
+export const npmPublish = async (pkg) => {
   const {absPath: cwd, name, version, manifest, config} = pkg
   if (manifest.private || config?.npmPublish === false) return
+
   const {npmRegistry, npmToken, npmConfig} = config
-  const npmrc = npmConfig ? npmConfig : path.resolve(cwd, '.npmrc')
+  const npmrc = npmConfig ? npmConfig : tempy.temporaryFile({name: '.npmrc'})
 
   log({pkg})(`publish npm package ${name} ${version} to ${npmRegistry}`)
-  $.cwd = cwd
+
   if (!npmConfig) {
-    await $.raw`echo ${npmRegistry.replace(/https?:/, '')}/:_authToken=${npmToken} >> ${npmrc}`
+    await fs.writeFile(npmrc, `${npmRegistry.replace(/^https?:\/\//, '//')}/:_authToken=${npmToken}`, {encoding: 'utf8'})
   }
-  await $`npm publish --no-git-tag-version --registry=${npmRegistry} --userconfig ${npmrc} --no-workspaces`
-})
+  await $.o({cwd})`npm publish --no-git-tag-version --registry=${npmRegistry} --userconfig ${npmrc} --no-workspaces`
+}
 
 // $`npm view ${name}@${version} dist.tarball`
 export const getTarballUrl = (registry, name, version) => `${registry}/${name}/-/${name.replace(/^.+(%2f|\/)/,'')}-${version}.tgz`

yarn.lock

@@ -86,10 +86,10 @@
   dependencies:
     tslib "^2.4.1"
 
-"@semrel-extra/topo@^1.9.0":
-  version "1.9.0"
-  resolved "https://registry.yarnpkg.com/@semrel-extra/topo/-/topo-1.9.0.tgz#9ca8cce1153fa0e746dbfb6b99de5715b784f916"
-  integrity sha512-R4jwDTWPaODKuDJfUws6wCN3jNmKgGro0q0XfitoSIeCpib7QmC2mP2MDIL5+PdrJtbPPnZQw0ccQJre5InWfg==
+"@semrel-extra/topo@^1.9.1":
+  version "1.9.1"
+  resolved "https://registry.yarnpkg.com/@semrel-extra/topo/-/topo-1.9.1.tgz#a60bf685fb0738e2e0aae41c59817ab23d4a56a7"
+  integrity sha512-5ya0CpvCzM+N8Rl54hNMwtuXij9IIYzbSTKhAPCqRgOGPjSktl8r1Lev4dLNl1D0bkGvACcMkiXKghZQfHYFgg==
   dependencies:
     fast-glob "^3.2.12"
     toposource "^1.1.3"