fix(README): correct docs on authentication

[swain]

Motivation

The documentation about authentication strategies seems to be incorrect.

The documentation implies that an NPM_TOKEN environment variable will take precedence over (and replace any token within) an .npmrc value:

Verify the presence of the NPM_TOKEN environment variable, create or update the .npmrc file with the token and verify the token is valid.

Based on the code here, that implication is not correct -- .npmrc files take precedence over both NPM_TOKEN and the legacy env variables. In particular, the return statement on line 29 is causing the environment variables to be ignored.

Changes

• Update the README to clearly communicate that .npmrc files will take precedence over the NPM_TOKEN environment variable.
• Added a test illustrating the behavior.

[gr2m]

Did you verify this behavior or is it just based on your assessment of the code? I do agree with your assessment but just want to be sure. Do you think we could add a test to confirm your assumption? I couldn't find one which tests the behavior if both an auth token is set in .npmrc and NPM_TOKEN is set, I think it would need to go into https://github.com/semantic-release/npm/blob/master/test/set-npmrc-auth.test.js

[swain]

@gr2m Great call-out. I've added a new commit with an illustrating test.

[gr2m]

Thanks, great PR 👍🏼

[github-actions]

🎉 This PR is included in version 8.0.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀