Stop adding `always-auth` to the `.npmrc` file

[hashtagchris]

Description:
Stop adding always-auth = (Boolean) to the .npmrc file by default.

Consider removing the always-auth actions input and all related code.

If there's an upcoming major release in the next year or so, this change can be incorporated into that to ensure stable workflows aren't impacted.

Justification:
always-auth was removed from the npm cli in 2021: npm/cli@72a7eeb. npm 6 (?) was the last release to honor this flag. See https://docs.npmjs.com/cli/v6/commands/npm-adduser vs newer docs.

npm cli 11 warns npm warn Unknown user config "always-auth". This will stop working in the next major version of npm.

Are you willing to submit a PR?
Yes

Related

Addition of always-auth: #48

Sample workflow run: https://github.com/hashtagchris/junk-drawer/actions/runs/15785443544/job/44500732542#step:5:8

Sample workflow

This reproduces the npm 11 warning

name: npm always-auth warning
on: workflow_dispatch

jobs:
  repro:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org/'

      - name: Install the latest version of the npm CLI
        run: |
          npm install -g npm@latest

      # Run various npm commands to trigger the warning
      - run: npm --version
      - run: npm config ls

      - name: Inspect the config set up by setup-node
        run: |
          cat /home/runner/work/_temp/.npmrc

[aparnajyothi-y]

Hello @hashtagchris, Thank you for creating this issue and we will look into it :)

[hbmartin]

Any updates? Would be great to get a timeline for fixing this so we don't encounter unexpected breakage on the next major npm release. This flag was removed nearly half a decade ago...

[kristof-kasa]

I'm also curious whether it will break npm installs due to this announcement: https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/
@aparnajyothi-y

[polomsky]

Hello. After some investigation why I am getting this warning I have found this issue.
From my perspective this is not a feature request, but bug report. When I am requesting to install node 24 I am getting this warning for feature, which was documented up to npm 6 (Node 14) but not for npm 7 (Node >=16.1), also mentioned in changelog. Probably not available since npm version 7.11.1
So, from my perspective, the correct fix would be stop adding it to any version of node greater than 16.0, but definitely not to add it in version 24 with npm 11 which is clearly complaining about it (if fix should be very conservative).

[andreasg123]

How would removing that impact yarn 1.22.22? That still gets used because it has a compact lock file format.

[andreasg123]

As always-auth isn't needed for scoped packages in yarn 1.22, the impact of removing support for always-auth should be minimal.
https://github.com/yarnpkg/yarn/blob/1.22-stable/src/registries/npm-registry.js#L149-L164