NPM Trusted Publishing

Overview

Set up secure npm publishing from GitHub Actions using OIDC trusted publishing instead of long-lived NPM_TOKEN secrets.

When to Use

• Setting up npm publish workflow in GitHub Actions
• Migrating from NPM_TOKEN to trusted publishing
• Adding provenance attestations to packages
• Publishing monorepo packages

Quick Reference