Drone runs each command list item in a separate shell, so a standalone NPM_HOST= line is empty when the next item references it, writing //:_auth= (wrong host) and causing a registry 401. Compute NPM_HOST in the same | block that writes .npmrc.
Drone runs each command list item in a separate shell, so a standalone NPM_HOST= line is empty when the next item references it, writing //:_auth= (wrong host) and causing a registry 401. Compute NPM_HOST in the same | block that writes .npmrc.