npm Trusted Publishing

Moves a GitHub Actions release from a stored NPM_TOKEN to npm trusted publishing. GitHub signs a short-lived OIDC token for the run, and npm exchanges it for a publish token. It also diagnoses the misleading errors a half-finished migration produces. From January 2027, granular tokens that bypass 2FA can no longer publish directly (npm docs).

When to Use This Skill

• The user wants to remove NPM_TOKEN / NODE_AUTH_TOKEN from a release workflow or set up OIDC or provenance publishing.
• A CI publish fails with ENEEDAUTH, 404 Not Found - PUT https://registry.npmjs.org/... or E422 ... repository.url.
• Release logs show npm notice npm tokens that bypass 2FA are being restricted.

Checklist (all must hold)

Work through every item. Missing any one of them produces the errors above.