Lerna doesn't work with NPM automation tokens

When I properly set up npm credentials inside of GitHub Actions, and use an npm automation token (which normally supports write actions), lerna fails when verifying npm auth, even though npm is properly authenticated for publishing:

$ lerna publish patch
....
lerna info Verifying npm credentials
lerna http fetch GET 403 https://registry.npmjs.org/-/npm/v1/user 241ms
403 Forbidden - GET https://registry.npmjs.org/-/npm/v1/user
lerna ERR! EWHOAMI Authentication error. Use `npm whoami` to troubleshoot.

When I switch to a read-write npm token (with OTP turned off), lerna works fine.

It appears lerna does not support npm automation tokens. It would be nice if it did, that way people won’t be inclined to turn off OTP on their human tokens.

[dyladan]

Using https://github.com/lerna/lerna/tree/main/commands/publish#--no-verify-access may fix this. Automation tokens don’t have permission to access the endpoint lerna uses to verify permission.

As a longer-term fix, this should be documented or the /-/whoami endpoint should be used which can be accessed by automation tokens.

[FRSgit]

This issue thread was a real life saver - I’ve just struggled with publishing the @frsource/tiny-carousel packages for two days before finding this gold. To make life easier for the future travellers, I’ve patched a PR adding the necessary info about handling of npm automation tokens - #2825. Hope it will save some time for the others 😄

Feel free to comment/post suggestions in the PR, or just react with 👍 if agree that it should be merged.