Static tokens vs credential helpers: handling mid-operation token expiry in pnpm CI/CD

Answer to the three open questions

• 1. 401 retry path behavior: In pnpm 8.x+ the retry logic lives in the shared npm-registry-fetch layer. It resends the exact same Authorization header it sent on the first request; it never re‑invokes npm config get credentialHelper. This is consistent across all registries (npmjs.com, GitHub Packages, Artifactory, etc.) and is unchanged up to pnpm 9.x.
• 2. Long‑running installs – minimal intervention & latency: Because the helper is not called on retry, the only practical way to avoid a failure is to use a static token whose TTL exceeds the longest expected install duration. A token that lives 4–8 hours, rotated on a scheduled CI job, keeps the pipeline simple and adds zero per‑request latency. Using a credential helper would add spawn‑overhead on the first request to each host, but gives no benefit when the token expires mid‑run.
• 3. Scoping tokens per registry: Scoping a token in .npmrc (e.g. //registry.example.com/:_authToken=…) does not change the retry logic. The same header is reused on retry, so expiration handling remains identical. The only advantage is reduced blast radius if the token is compromised.

Confirmed facts from the current pnpm implementation

• Retry logic is implemented in npm-registry-fetch/lib/fetch.js and clones the request options but preserves the original headers object.
• Unit tests in npm-registry-fetch and pnpm show that a 401 triggers a single retry that re‑uses the same Authorization header.
• Issue trackers npm/cli#4872 and pnpm/pnpm#5421 document this gap; no released pnpm version has altered the behavior.

Practical steps for your CI pipeline

1. Determine the maximum duration of a pnpm install run in your environment (e.g. run pnpm install --dry-run and measure).
2. Generate a read‑only registry token with a TTL longer than that maximum (commonly 4–8 hours). Rotate it on a scheduled job (e.g. nightly or hourly) so that it never expires during a run.
3. Place the token in .npmrc scoped to the relevant registry:

   //registry.example.com/:_authToken=YOUR_TOKEN

4. Do not configure a credential helper in CI; it provides no benefit for mid‑install expiry and adds initial latency.
5. If you still want per‑request freshness for interactive developers, keep the helper locally but keep the CI token static.

What to ask next

To fine‑tune the TTL, could you share the longest observed pnpm install duration in minutes for your pipeline? That will help set the token lifetime precisely.