npm-trusted-publishing-github-workflow
NPM Trusted Publish
Goal
Implement the same hardened npm trusted publishing pattern every time, without rediscovering the details from CI logs.
Related skills
This skill generates and debugs the publish workflow file. For the surrounding security posture — account and repository 2FA, branch protection, GitHub publish environments, release-strategy choice, and sole-maintainer risk — use the npm-package-publishing skill. The two are complementary: npm-package-publishing decides how publishing should be set up, this skill writes and fixes the YAML that does it.
One number to keep consistent between the two: both skills use Node 24.8.0 or higher as the publish-step floor. Node 24.8.0 bundles npm 11.6.0, which already exceeds the npm CLI 11.5.1 minimum that trusted publishing requires, so on that floor no manual npm upgrade is needed. If a project must publish on an older Node, it has to upgrade npm to 11.5.1 or later first — the publish job retains a guard step for exactly that case.