Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

9.0.1, 8.15.7

Which area(s) of pnpm are affected? (leave empty if unsure)

CLI, Package manager compatibility

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

Publishing a package using a tarball file ignores the tarball file. We are using Verdaccio in this example but it should be the same with any registry.

pnpm publish "my-package.tgz" --registry http://localhost:4873

Describe the Bug

The pnpm publish command ignores the tarball file and publishes any files from where the command is executed. For example from the root of a pnpm workspace, the whole workspace is used as tarball content instead of publishing the tarball itself.

This Pull Request may be related to this regression: https://github.com/pnpm/pnpm/pull/7862/files#diff-127f241b935e019728580ecc720e373a97b8023966522f00bd0dba82c4a06bb0R203

This command worked as expected with PNPM v8.15.1, and the regression is present in v8.15.7 and v9.0.1.

Not working:

pnpm publish "my-package.tgz" --registry http://localhost:4873

Working with a substitution to NPM v10.2.4:

npm publish "my-package.tgz" --registry http://localhost:4873

Expected Behavior

THe publish command should publish the tarball file.

Which Node.js version are you using?

v18.19.1

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

No response