Fix: check project directory for .npmrc first

[GfxKai]

Proposed changes:

1. Check project directory for .npmrc first
2. Use project directory as default location for creating one if none found

---

NPM prioritises project-level .npmrc above the config defined at the user level (see here).

Current behaviour does not check the project directory for an .npmrc so our release stage fails in CI, despite having a valid .npmrc file pointing to a private GitLab registry.

If no .npmrc is found, creating one in the project repo feels safer than creating one in home—the change is obvious, explicit and scoped to the project rather than the user.

[changeset-bot]

🦋 Changeset detected

Latest commit: da26308

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
changesets-gitlab	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

[JounQin]

Thanks for PR first. Is this an accepted upstream feature? I don't want to have many differences with upstream repository.

[pmjhonwang]

Proposed changes:

1. Check project directory for .npmrc first
2. Use project directory as default location for creating one if none found

NPM prioritises project-level .npmrc above the config defined at the user level (see here).

Current behaviour does not check the project directory for an .npmrc so our release stage fails in CI, despite having a valid .npmrc file pointing to a private GitLab registry.

If no .npmrc is found, creating one in the project repo feels safer than creating one in home—the change is obvious, explicit and scoped to the project rather than the user.

I did these in docker image build

[JounQin]

This could be breaking change, because a project level .npmrc could contain no registry config with auth token.

[JounQin]

I believe you can just provide a fake NPM_TOKEN environment variable to bypass the check.