fix(publish) Support split npmrc auth for publish

[gavinhailey]

What does this PR do?

Fixes bun publish failing with "error: missing authentication" despite valid .npmrc credentials, while bun install and npm publish both work fine with the same configuration. Updates the auth check to accept the registry.auth and registry.user combination that gets set.

This specifically affects split username/password authentication like:

//registry.example.com/:username=myuser
//registry.example.com/:_password=base64encodedpass

Related Issues

• bun publish fails with authentication error despite valid .npmrc in GitHub Actions #24124
• Cannot publish to custom registry, npm can with the same config #18670

How did you verify your code works?

New auth tests in test/cli/install/bun-publish.test.ts, four new tests verify different .npmrc authentication formats:

• Split username/password with default registry (fails on current release)
• Split username/password with scoped registry (fails on current release)
• Split _authToken with default registry (already worked, but expanded coverage)
• Split _authToken with scoped registry (already worked, but expanded coverage)

Manual testing with debug release:

Tested publishing to a private JFrog Artifactory registry using split username/password in .npmrc:

@scope:registry=https://registry.example.com/npm/
//registry.example.com/npm/:username=myuser
//registry.example.com/npm/:_password=YmFzZTY0ZW5jb2RlZHBhc3M=

Before fix: ❌ error: missing authentication
After fix: ✅ + @scope/abcefg@0.1.0-rc.0

[coderabbitai]

Walkthrough

Broadened the authentication condition in PublishCommand.publish to require missing token, auth, and user (plus incomplete URL-embedded credentials). Added tests covering split npmrc authentication formats (username/password and _authToken) for scoped and unscoped registries against Verdaccio.

Changes

Cohort / File(s)	Summary
Publish command logic src/cli/publish_command.zig	Adjusted authentication-check logic: NeedAuth now triggers only when token, auth, and user are all absent and URL-embedded credentials are incomplete (+2/-1).
Publish tests (split npmrc auth) test/cli/install/bun-publish.test.ts	Added test suite validating four split npmrc authentication formats (username/password and _authToken, each with scoped and unscoped registry cases) against a Verdaccio registry (+89/-0).

Possibly related PRs

• Fix --tolerate-republish flag in bun publish (continues PR #22107) #22381 — Modifies PublishCommand.publish; introduces tolerate_republish/version-existence checks in the same publish flow, overlapping the publish/authentication code paths.

Suggested reviewers

• dylan-conway

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: fixing bun publish to support split npmrc authentication, which directly matches the core objective of the PR.
Description check	✅ Passed	The description fully covers both required template sections with clear explanations of the problem, solution, related issues, and comprehensive verification through multiple test scenarios and manual testing.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In `@src/cli/publish_command.zig`:
- Around line 537-539: The auth gate in publish_command.zig incorrectly requires
both registry.auth and registry.user to be set, causing false NeedAuth errors
when legacy _auth populates only registry.auth; update the condition so it
accepts any of: registry.token non-empty, registry.auth non-empty OR
registry.user non-empty, or URL-embedded credentials
(registry.url.username/registry.url.password), i.e., check registry.auth.len > 0
|| registry.user.len > 0 rather than requiring both; ensure this logic aligns
with constructPublishHeaders which already uses registry.auth.

In `@test/cli/install/bun-publish.test.ts`:
- Around line 1014-1018: Reorder the assertions in the test so stdout/stderr
expectations run before checking the process exit code: move the
expect(out).toContain(`+ ${format.packageName}@1.0.0`) and
expect(err).not.toContain("missing authentication") to precede
expect(exitCode).toBe(0) in the test that calls publish(env, packageDir)
(variables: out, err, exitCode, and helper publish).