Breaking: use a separate script to publish to the npm registry

(refs eslint/eslint#10631)

This updates the release API to not publish to npm when initially
called, and to only publish to npm when invoked as a separate process.
This will make it possible to pause the build to ask the user for a TOTP
code before publishing, provided that consumers of the package are
updated accordingly.

bin/eslint-publish.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+
+/**
+ * @fileoverview CLI to publish a package to npm after changelog and package.json have been updated
+ * @author Teddy Katz
+ * @copyright jQuery Foundation and other contributors, https://jquery.org/
+ * MIT License
+ */
+
+"use strict";
+
+var ReleaseOps = require("../lib/release-ops");
+
+ReleaseOps.publishReleaseToNpm();

lib/release-ops.js

@@ -415,13 +415,7 @@ function release(prereleaseId, ciRelease) {
         fs.writeFileSync(".npmrc", "//registry.npmjs.org/:_authToken=${NPM_TOKEN}");
     }
 
-    // if there's a prerelease ID, publish under "next" tag
-    console.log("Publishing to npm");
-    if (prereleaseId) {
-        ShellOps.exec("npm publish --tag next");
-    } else {
-        ShellOps.exec("npm publish");
-    }
+    console.log("Not publishing to npm. To publish, run: npm publish" + (prereleaseId ? " --tag next" : ""));
 
     // undo any differences
     if (!ciRelease) {
@@ -473,6 +467,20 @@ function publishReleaseToGitHub(releaseInfo) {
 
 }
 
+function publishReleaseToNpm() {
+    // if there's a prerelease ID, publish under "next" tag
+    console.log("Publishing to npm");
+    if (!process.env.NPM_OTP) {
+        throw new TypeError("NPM_OTP environment variable must be set to publish a package");
+    }
+
+    if (semver.prerelease(getPackageInfo().version)) {
+        ShellOps.exec("npm publish --tag next --otp " + process.env.NPM_OTP);
+    } else {
+        ShellOps.exec("npm publish --otp" + process.env.NPM_OTP);
+    }
+}
+
 //------------------------------------------------------------------------------
 // Public API
 //------------------------------------------------------------------------------
@@ -483,5 +491,6 @@ module.exports = {
     calculateReleaseInfo: calculateReleaseInfo,
     calculateReleaseFromGitLogs: calculateReleaseFromGitLogs,
     writeChangelog: writeChangelog,
-    publishReleaseToGitHub: publishReleaseToGitHub
+    publishReleaseToGitHub: publishReleaseToGitHub,
+    publishReleaseToNpm: publishReleaseToNpm
 };

package.json

@@ -10,7 +10,8 @@
     "eslint-release": "./bin/eslint-release.js",
     "eslint-ci-release": "./bin/eslint-ci-release.js",
     "eslint-gh-release": "./bin/eslint-gh-release.js",
-    "eslint-prerelease": "./bin/eslint-prerelease.js"
+    "eslint-prerelease": "./bin/eslint-prerelease.js",
+    "eslint-publish": "./bin/eslint-publish.js"
   },
   "scripts": {
     "test": "npm run lint && mocha tests/lib/*.js",