[rush] Fix rush publish for projects using pnpm catalog: dependencies

[Bharat Middha (bmiddha)]

Summary

rush publish (--publish or --pack) failed for any published project that used a pnpm catalog: / catalog:default specifier from globalCatalogs:

ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_SPEC  No catalog entry 'is-number' was found for catalog 'default'.

rush install, rush update, and rush-pnpm pack/publish all worked. This PR points pnpm publish / pnpm pack at an isolated, catalog-only pnpm workspace so that catalog: specifiers are rewritten correctly.

Related: #5623, #5467, #5627

Details

PublishAction runs pnpm publish / pnpm pack from the project's publish folder. pnpm rewrites catalog: specifiers using pnpm-workspace.yaml, which it finds by searching upward from the working directory. Rush generates that file in common/temp (or the subspace temp folder), and that folder is not a parent of the project, so pnpm found no catalogs.

rush-pnpm avoids this by setting NPM_CONFIG_WORKSPACE_DIR to the subspace temp folder. rush publish can't reuse that folder: pnpm's publish copies <workspaceDir>/.npmrc into its temporary publish folder whenever the project has no .npmrc, then runs npm publish there (copyNpmrc in pnpm 10). The install-time .npmrc would then become project-level npm config and override common/config/rush/.npmrc-publish, which Rush supplies only at the user level through the publish-home HOME redirect.

Instead, for each subspace that has catalogs configured, Rush now generates common/temp/publish-workspaces/<subspace>/pnpm-workspace.yaml. That file contains only catalogs, and the folder has no .npmrc. Rush then sets NPM_CONFIG_WORKSPACE_DIR to that folder for #npmPublishAsync and #npmPackAsync. The folder is created once per subspace per run.

• Each project resolves against its own subspace's catalogs (subspace.getPnpmOptions() ?? rushConfiguration.pnpmOptions).
• npm config resolution is the same as before, so .npmrc-publish, --registry, and --npm-auth-token behave as they did.
• Only runs when isPnpm && useWorkspaces and globalCatalogs is non-empty. Repos without catalogs, and npm and Yarn repos, see no change.
• rush publish already rewrites workspace: ranges itself, so the generated workspace only needs catalogs and does not list any packages.

How it was tested

Build: node common/scripts/install-run-rush.js build --to @microsoft/rush passed, with lint included.

I tested manually with pnpm 10.26.0 and useWorkspaces: true on two scratch repos:

1. Single workspace: lib-a depends on "is-number": "catalog:", and globalCatalogs.default pins 7.0.0.
2. Subspaces: lib-a is in subspace sa (catalog 7.0.0), and lib-b is in subspace sb (catalog 6.0.0).

Command	Released 5.181.0	This PR (apps/rush/lib-commonjs/start-dev.js)
rush publish --include-all --pack (single)	❌ ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_SPEC	✅ tarball has "is-number": "7.0.0"
rush publish --include-all --pack (subspaces)	❌ same error	✅ lib-a → 7.0.0, lib-b → 6.0.0
rush publish --include-all --publish (single)	❌ same error	✅ published manifest has "is-number": "7.0.0"
rush publish --include-all --publish (subspaces)	❌ same error	✅ lib-b published with "is-number": "6.0.0"

.npmrc-publish precedence. I set up two Verdaccio instances. The install .npmrc points at 127.0.0.1:4874, which rejects publishes. common/config/rush/.npmrc-publish points at 127.0.0.1:4873 with an auth token. I passed no --registry or --npm-auth-token.

• If the workspace dir is the subspace temp folder (the first revision of this PR, simulated with released 5.181.0 and NPM_CONFIG_WORKSPACE_DIR=common/temp), publish fails with ENEEDAUTH ... http://127.0.0.1:4874/. The copied install .npmrc overrides .npmrc-publish.
• With this PR, the package is published to 127.0.0.1:4873 with the catalog version resolved.

All manual testing was done on the final commit. I did not add unit tests because PublishAction has no existing test harness.

[Copilot]

🟡 Changes recommended

Install-time registry and credential settings can override .npmrc-publish, causing incorrect registry selection or authentication failures.

1 open finding

• pnpm publish overrides publish config with install-time .npmrc · New

What changed in this PR

This PR enables Rush’s publishing workflow to resolve pnpm catalog dependencies using each project’s generated subspace workspace.

Changes:

• Configure the workspace directory for pnpm publish and pack when workspaces are enabled.
• Add a Rush change entry describing the fix.

File	Description
libraries/​rush-lib/​src/​cli/​actions/​PublishAction.ts	Pass the project’s subspace workspace to pnpm publish and pack.
common/​changes/​@microsoft/​rush/​fix-rush-publish-pnpm-catalogs_2026-10-14-04-30.json	Record the catalog publishing fix.

🧠 Review effort: Max

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Version-dependent pnpm workspace and .npmrc behavior in the release path needs human validation beyond the reported pnpm 10.26.0 testing.

1 open finding

• Reuse RushConstants.pnpmWorkspaceFileName · New

1 resolved since last review

• pnpm publish overrides publish config with install-time .npmrc

🧠 Review effort: Max

[Copilot]

🔵 Needs a closer look

The publishing configuration changes depend on pnpm-specific behavior validated only manually on pnpm 10.26.0, warranting human review.

0 open findings

1 resolved since last review

• Reuse RushConstants.pnpmWorkspaceFileName

🧠 Review effort: Max