You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+28-33Lines changed: 28 additions & 33 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -39,9 +39,7 @@ jobs:
39
39
registry-url: "https://registry.npmjs.org"
40
40
- run: npm ci
41
41
- run: npm test
42
-
- run: npm publish --provenance --ignore-scripts
43
-
env:
44
-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
42
+
- run: npm publish --ignore-scripts
45
43
```
46
44
47
45
See GitHub's [Node.js publishing][] guide and npm's [trusted publishing][] docs for more details and examples.
@@ -78,7 +76,7 @@ This package can be used three different ways:
78
76
79
77
## GitHub Action
80
78
81
-
To use the GitHub Action, you'll need to add it as a step in your [workflow file][]. By default, the only thing you need to do is set the `token` parameter to your [npm authentication token][].
79
+
To use the GitHub Action, you'll need to add it as a step in your [workflow file][]. By default, the only thing you need to do is set `permissions.id-token` to `write` to enable [trusted publishing][] via OIDC.
82
80
83
81
```yaml
84
82
on:
@@ -88,6 +86,9 @@ on:
88
86
jobs:
89
87
publish:
90
88
runs-on: ubuntu-latest
89
+
permissions:
90
+
contents: read
91
+
id-token: write
91
92
steps:
92
93
- uses: actions/checkout@v5
93
94
- uses: actions/setup-node@v5
@@ -96,33 +97,29 @@ jobs:
96
97
- run: npm ci
97
98
- run: npm test
98
99
- uses: JS-DevTools/npm-publish@v4
99
-
with:
100
-
token: ${{ secrets.NPM_TOKEN }}
101
100
```
102
101
103
-
If you have [trusted publishing][] configured for your package and use `npm@>=11.5.1`, you can omit the `token` input and use OIDC instead.
104
-
105
102
> [!IMPORTANT]
106
-
> If you're publishing a private package, you will still need to provide a read-only `token` so the action can read existing versions from the registry before publish.
107
-
108
-
```diff
109
-
jobs:
110
-
publish:
111
-
runs-on: ubuntu-latest
112
-
+ permissions:
113
-
+ contents: read
114
-
+ id-token: write # required to use OIDC
115
-
steps:
116
-
- uses: actions/checkout@v5
117
-
- uses: actions/setup-node@v5
118
-
with:
119
-
node-version: "24" # includes npm@11.6.0
120
-
- run: npm ci
121
-
- run: npm test
122
-
- uses: JS-DevTools/npm-publish@v4
123
-
- with:
124
-
- token: ${{ secrets.NPM_TOKEN }}
125
-
```
103
+
> If you're publishing a private package with [trusted publishing][], you will still need to provide a read-only [`token`][npm authentication token] so the action can read existing versions from the registry before publish.
104
+
>
105
+
> ```diff
106
+
> jobs:
107
+
> publish:
108
+
> runs-on: ubuntu-latest
109
+
> permissions:
110
+
> contents: read
111
+
> id-token: write # required to use OIDC
112
+
> steps:
113
+
> - uses: actions/checkout@v5
114
+
> - uses: actions/setup-node@v5
115
+
> with:
116
+
> node-version: "24" # includes npm@11.6.0
117
+
> - run: npm ci
118
+
> - run: npm test
119
+
> - uses: JS-DevTools/npm-publish@v4
120
+
> - with:
121
+
> - token: ${{ secrets.NPM_TOKEN }}
122
+
> ```
126
123
127
124
You can also publish to third-party registries. For example, to publish to the [GitHub Package Registry][], set `token` to `secrets.GITHUB_TOKEN` and `registry` to `https://npm.pkg.github.com`:
128
125
@@ -161,7 +158,7 @@ You can set any or all of the following input parameters using `with`:
0 commit comments