npmToken with template secrets and npmrc does not work

[rarkins]

For context, my original setup—which needed migration—looks like this:

"encrypted": {
  "npmToken": "wcFMA/xDdHCJBTolAQ/........."
}
"npmrc": "@<ORG_NAME>:registry=https://npm.pkg.github.com/\n//npm.pkg.github.com/:_authToken=${NPM_TOKEN}",

Note

<ORG_NAME> is replaced with the actual organization name that contains private NPM packages

I couldn't get npmToken to work again after migrating to secret and unwrapping it from the encrypted object. Renovatebot complains that it has no access to the private packages, indicating it has issues access the secret.

I've tried:

• Copying the old encrypted token and pasting it as a secret ("migrate" secret)
• Copying the unencrypted token and pasting it

Neither worked.

// WARNING: This does not work
"npmToken": "{{ secrets.NPM_TOKEN }}",
"npmrc": "@<ORG_NAME>:registry=https://npm.pkg.github.com/\n//npm.pkg.github.com/:_authToken=${NPM_TOKEN}",

What worked for me is to introduce it as a hostType entry:

"hostRules": [
  {
    "matchHost": "https://npm.pkg.github.com/",
    "hostType": "npm",
    "token": "{{ secrets.NPM_TOKEN }}"
  }
],
"npmrc": "@<ORG_NAME>:registry=https://npm.pkg.github.com/\n//npm.pkg.github.com/:_authToken=${NPM_TOKEN}",

Originally posted by @terrymun in #31253 (comment)

[terrymun]

Thanks for looking into this @rarkins ❤️

[viceice]

we should deprecate npmToken and migrate it to a host rule