actions-npm

Use when creating or debugging GitHub Actions workflows that publish npm packages with trusted publishing / OIDC.

IndexedApache-2.0★ 2

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/jsonlee12138-actions-npm

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Use when creating or debugging GitHub Actions workflows that publish npm packages with trusted publishing / OIDC. Triggers on npm publish in CI, ENEEDAUTH, E404 or E422 during publish, tag-triggered releases, setup-node auth behavior, or provenance issues in public vs private GitHub repositories.

Use cases: devops, security

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found

Network hosts it talks to 1

codeload.github.com · found in install command

Files it touches

~/.claude/skills/actions-npm

What's inside

Skill name: actions-npm
Description: Use when creating or debugging GitHub Actions workflows that publish npm packages with trusted publishing / OIDC. Triggers on npm publish in CI, ENEEDAUTH, E404 or E422 during publish, tag-triggered releases, setup-node auth behavior, or provenance issues in public vs private GitHub repositories.
License: Apache-2.0
Instructions: 49 lines in SKILL.md · view on GitHub

Files (2)

SKILL.md
release-npm.yml · assets/

SKILL.md (first lines)

# Actions NPM Publish (Trusted Publishing)

## Workflow Template

See [assets/release-npm.yml](assets/release-npm.yml) — 可直接复制到 `.github/workflows/` 使用。

## How It Works

trusted publishing 用 GitHub OIDC 替代长期有效的 `NPM_TOKEN`：

1. workflow 运行在 GitHub-hosted runner 上
2. job 具备 `permissions.id-token: write`
3. npm / `actions/setup-node` 用 GitHub OIDC 身份换取发布凭证
4. `npm publish` 使用该凭证发布

**不需要 `NPM_TOKEN` secret。**

## Verified Requirements

- workflow 必须在 `.github/workflows/`
- 必须使用 GitHub-hosted runner
- 必须有 `id-token: write`
- npm trusted publisher 必须精确匹配仓库和 workflow 文件名，例如 `release-auth-sdk.yml`
- `package.json.repository.url` 必须匹配 GitHub 仓库 URL
- 推荐 `actions/setup-node@v6`
- 推荐 Node 24；如果保留 Node 22，需确认 npm 已升级到 `11.5.1+`

## Important Gotchas

- 使用 `actions/setup-node@v6` 时，不要再手动设置 `NODE_AUTH_TOKEN: ""`。按实测，这种组合会导致 `ENEEDAUTH`；优先让 `setup-node` 自己处理发布凭证。
- `npm notice Publishing to https://registry.npmjs.org/` 之后再报 `E404`，通常说明认证已经通过，但 npm 侧的包权限、scope 权限，或 trusted publisher 元数据仍不匹配。
- `E422 ... Unsupported GitHub Actions source repository visibility: "private"` 表示 private GitHub 仓库不支持 `--provenance`。此时去掉 `--provenance`，保留普通 trusted publishing 即可。
- provenance 目前只适用于 public source repository。

## Publish Command

- public GitHub repo: `npm publish --provenance --access public`
- private GitHub repo: `npm publish --access public`

## Quick Checklist

- `actions/setup-node@v6`
- `node-version: "24"`
- `registry-url: https://registry.npmjs.org/`
- 不配置 `NPM_TOKEN`
- 不手动覆盖 `NODE_AUTH_TOKEN`
- npm 后台 trusted publisher 中的 workflow filename 与实际文件名完全一致

From JsonLee12138/prompts, Apache-2.0.

Signals

Stars: 2
Forks: 0
Open issues: 0
Last commit (this folder): May 11, 2026 (5 months ago)

From GitHub (fetched Oct 24, 2026).

Details

License: Apache-2.0
Repository: github.com/JsonLee12138/prompts
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from JsonLee12138

Cite this page

actions-npm skill. Agent Mart. https://agentmart.dev/skills/jsonlee12138-actions-npm (last updated 2026-10-24)