What is an npm Trusted Publisher?

A Trusted Publisher allows you to authenticate your npm releases from GitHub Actions using OIDC, which is more secure than using static, long-lived authentication tokens.

How does npm-trustme handle authentication?

It uses Playwright to open a real browser session, allowing you to perform the required one-time WebAuthn or security key approval needed by the npm registry.

What are the system requirements for this skill?

This skill requires Node.js version 22 or higher and the installation of Playwright browsers via 'npx playwright install'.

Can I use npm-trustme in automated CI environments?

While the initial setup requires a browser for WebAuthn, once configured, the Trusted Publisher allows your CI/CD environment to publish without manual intervention.

NPM Trusted Publisher Automator

Name: NPM Trusted Publisher Automator
Author: regenrek

byregenrek

•

デプロイメントとDevOps

Automates the setup and verification of npm Trusted Publishers for GitHub Actions using browser-driven CLI tools.

npm-trustme is a specialized tool designed to simplify the manual process of configuring OIDC-based Trusted Publishers on npm. By leveraging Playwright browser automation, it handles the complex parts of the npm web UI setup, including guiding users through WebAuthn requirements and passkey approvals. It provides a robust set of commands to ensure, check, and initialize GitHub Actions workflows, making it an essential utility for developers looking to replace long-lived npm tokens with secure, short-lived OIDC credentials.

主な機能

01Automated Trusted Publisher configuration for GitHub Actions

02Flexible browser automation with Playwright and Chrome profile support

033 GitHub stars

04Automatic generation of release workflows

05Verification and 'doctor' checks for npm publishing health

06Persistent authentication storage and cookie management

ユースケース

01Securing npm package releases by migrating from legacy tokens to OIDC Trusted Publishers.

02Bootstrapping new projects with pre-configured GitHub Actions for automated deployment.

03Auditing existing repository configurations to ensure publishing security compliance.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add regenrek/npm-trustme npm-trustme

For use in Claude.ai and ChatGPT

Download Skill