actions-npm

Actions NPM Publish (Trusted Publishing)

Workflow Template

See assets/release-npm.yml — can be copied directly to .github/workflows/ for use.

trusted publishing uses GitHub OIDC to replace long-lived NPM_TOKEN：

the workflow runs on a GitHub-hosted runner
the job has permissions.id-token: write
npm / actions/setup-node use the GitHub OIDC identity to exchange for publishing credentials
npm publish publish using those credentials

no need for NPM_TOKEN secret。

the workflow must be in .github/workflows/
a GitHub-hosted runner must be used
there must be id-token: write
the npm trusted publisher must exactly match the repository and workflow filename, for example release-auth-sdk.yml
package.json.repository.url must match the GitHub repository URL
recommended actions/setup-node@v6
Node 24 is recommended; if you keep Node 22, confirm that npm has been upgraded to 11.5.1+

When using actions/setup-node@v6 , do not manually set NODE_AUTH_TOKEN: ""again. Based on testing, this combination causes ENEEDAUTH; prefer to let setup-node handle the publishing credentials itself.
npm notice Publishing to https://registry.npmjs.org/ after that, an error is reported E404, which usually means authentication has already passed, but the package permissions, scope permissions, or trusted publisher metadata on the npm side still do not match.
E422 ... Unsupported GitHub Actions source repository visibility: "private" indicates that private GitHub repositories do not support --provenance. In this case, remove --provenanceand keep ordinary trusted publishing.
provenance currently only applies to public source repositories.

actions/setup-node@v6
node-version: "24"
registry-url: https://registry.npmjs.org/
do not configure NPM_TOKEN
do not manually override NODE_AUTH_TOKEN
the workflow filename in the npm backend trusted publisher must exactly match the actual filename