NPM Publish CI/CD Workflow FAQs

Question 1

What is a Trusted Publisher?

Accepted Answer

A Trusted Publisher is a configuration on npm that links a specific GitHub repository and workflow to a package, allowing that package to be published automatically upon successful workflow completion.

Question 2

Does this skill work with interactive CLI tools?

Accepted Answer

This skill specifically provides a workflow for manual changeset creation to avoid common issues with interactive CLIs in automated and containerized environments.

Question 3

Can I use this skill with Bun publish?

Accepted Answer

While Bun is used for building and packing, this skill utilizes the npm CLI for the final publish step because it currently provides better native support for OIDC authentication.

Question 4

How does OIDC authentication improve npm security?

Accepted Answer

OIDC (OpenID Connect) allows GitHub Actions to authenticate directly with npm using short-lived tokens, eliminating the need to store sensitive, long-lived NPM_TOKEN secrets in your repository settings.

Question 5

Why is 'workspace:*' resolution handled separately?

Accepted Answer

Standard npm publish commands often fail to resolve local workspace protocols into actual version numbers, leading to 'Cannot find module' errors for end-users. This skill uses a custom packing step to ensure dependencies are correctly resolved.

NPM Publish CI/CD Workflow

主な機能

ユースケース

NPM Publish CI/CD Workflow

主な機能

ユースケース