Remove npm dependency

[esanzgar]

Rely exclusively on yarn.

[codecov]

Codecov Report

Merging #2670 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #2670   +/-   ##
=======================================
  Coverage   97.73%   97.73%           
=======================================
  Files         199      199           
  Lines        7517     7517           
  Branches     1648     1648           
=======================================
  Hits         7347     7347           
  Misses        170      170           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0e74bb6...3fbc1a2. Read the comment docs.

[robertknight]

I had a couple of queries about the yarn publish change given the comments just above the changed line.

[robertknight]

I had a query about the ENV_TOKEN environment variable.

[esanzgar]

I had a query about the ENV_TOKEN environment variable.

I corrected it to NPM_TOKEN.

More here about the NPM_TOKEN:
https://docs.npmjs.com/using-private-packages-in-a-ci-cd-workflow

[robertknight]

I did a little more research this morning and I have another query about the NPM_TOKEN line.

[robertknight]

Have you confirmed that yarn publish definitely uses NPM_TOKEN if it is set this way and .npmrc is not present?

From what I can tell looking at the yarn issues there is no built-in support for NPM_TOKEN in yarn itself. Instead there is a feature where .npmrc can contain references to environment variables and there is a convention to write //registry.npmjs.org/:_authToken=${NPM_TOKEN} into the .npmrc file. See yarnpkg/yarn#1207.

I did however find a reference to NPM_AUTH_TOKEN (and also YARN_AUTH_TOKEN) in the yarn sources: https://github.com/yarnpkg/yarn/blob/a4708b29ac74df97bac45365cba4f1d62537ceb7/src/cli/commands/login.js#L64

The other issue I see here is that a .npmrc file could currently be left over from a previous build and I'm not sure what happens if the auth token is set in both places.

The simplest remedy I can see here is to keep the "sh echo '..." line unless you're sure that setting NPM_TOKEN on its own works, and just change the line that invokes npm publish.

[esanzgar]

Yes, I confirm that it works with NPM_TOKEN.

I have reverted the sh "echo... line.

[robertknight]

LGTM