How to install/publish packages from multiple `@scope` and multiple registers?

How to install packages from multiple @scope and multiple registers? I have settings .npmrc in the root of the project:

@scope1:registry=https://npm.pkg.github.com
@scope2:registry=https://npm.pkg.github.com
@scope3:registry=https://npm.anysite.org
@scope4:registry=https://registry.npmjs.org

and npmjs.com by default for a public

I need to create something like this settings .npmrc in the home folder before installing:

//npm.pkg.github.com/:_authToken=<TOKEN_A>
//nnpm.anysite.org/:_authToken=<TOKEN_B>
//registry.npmjs.org/@scope4/:_authToken=<TOKEN_C>

or

//npm.pkg.github.com/@scope1/:_authToken=<TOKEN_A1>
//npm.pkg.github.com/@scope2/:_authToken=<TOKEN_A2>
//nnpm.anysite.org/:_authToken=<TOKEN_B>
//registry.npmjs.org/@scope4/:_authToken=<TOKEN_C>

[IgorNovozhilov]

given this: #49, #52, #53, #64. a the optimal solution would be something like this:

    steps:
    - uses: actions/checkout@v1
    - uses: actions/setup-node@v1
      with:
        node-version: 10.x
        npm-registry:
          - registry: 'https://npm.pkg.github.com'
            scope: '@scope1'
            token: '${{secrets.GITHUB_TOKEN}}'
          - registry: 'https://npm.pkg.github.com'
            scope: '@scope2'
            token: '${{secrets.GITHUB_TOKEN_THIRD_PARTY}}'
          - registry: 'https://nnpm.anysite.org'
            token: '${{secrets.ANYSITE_TOKEN}}'
          - registry: 'https://registry.npmjs.org'
            scope: '@scope4'
            token: '${{secrets.NPMJS_TOKEN}}'
    - run: npm install
    - run: npm test
    - run: npm publish

where, npm-registry - written in .npmrc in the home folder, and is used for all subsequent commands GITHUB_TOKEN - access the current organization GITHUB_TOKEN_THIRD_PARTY - may be a Personal access tokens. Or a Organization access tokens. Yeah, that’s really missing on GitHub, but this would be crucial for using third-party packages from a security perspective

This solution would be universal for both installing and publishing packages, including publishing into multiple repositories at once.

[WtfJoke]

And what is the current workaround (e.g. how do you write your .npmrc file in the action)?

We have a file called .npmrc_ci and then replace the environment variable in the action run.

.npmrc_ci:

always-auth = true
@bar:registry=https://someartifactory.jfrog.io/artifactory/api/npm/public-npm/
@foo:registry=https://someartifactory.jfrog.io/artifactory/api/npm/public-npm/

//someartifactory.jfrog.io/artifactory/api/npm/public-npm/:_authToken=${NODE_AUTH_TOKEN}

This is the workflow step which replaces the variable:

      - name: Prepare npmrc
        run: envsubst  < .npmrc_ci > .npmrc
        env:
          NODE_AUTH_TOKEN: '${{ secrets.NODE_AUTH_TOKEN}}'

I dont think there is an easy fix for that issue. As far as I know its not possible to provide lists as action input variables (only single value/key), see https://github.com/actions/toolkit/issues/184. So you probably end up with some separator which doesnt look nice.