What is npm Trusted Publishing?

It is a secure method for publishing packages to npm from GitHub Actions using short-lived OpenID Connect (OIDC) tokens instead of permanent, manually managed secrets.

Do I still need to store an NPM_TOKEN in GitHub Secrets?

No, once Trusted Publishing is configured on npmjs.com and your GitHub workflow has the correct OIDC permissions, the NPM_TOKEN secret is no longer required.

Why does my npm publish fail with a 422 error in CI?

A 422 error usually indicates a metadata mismatch, typically because the 'repository.url' field in your package.json does not exactly match the GitHub repository URL.

How do I enable package provenance?

To enable provenance, ensure your GitHub Action has 'id-token: write' permissions and add the '--provenance' flag to your 'npm publish' command.

Which Node.js version is required for OIDC publishing?

For reliable Trusted Publishing and provenance support, you should use Node.js 22.14.0 or higher and npm 11.5.1 or higher.

npm Trusted Publishing OIDC - Claude Code Skill

This skill streamlines the transition from long-lived NPM_TOKEN secrets to secure, short-lived OIDC tokens for GitHub Actions. It provides automated guidance for setting up GitHub permissions, ensuring Node.js and npm version compatibility, and validating critical package.json metadata to prevent common deployment failures. By implementing provenance-backed publishing, it enhances the security and transparency of your package supply chain while troubleshooting frequent CI/CD errors like 404 registry mismatches and 422 metadata validation issues.

Key Features

01Ensures compliance with Node.js 22.14.0+ and npm 11.5.1+ requirements

02Debugs common CI/CD publishing failures including 403 Forbidden and 404 Not Found errors

03Configures GitHub Actions OIDC permissions for tokenless authentication

04Validates package.json repository metadata to prevent 422 Unprocessable Entity errors

05Provides optimized workflow templates with provenance-backed publishing

064,346 GitHub stars

Use Cases

01Migrating from legacy npm secrets to secure OIDC-based publishing in GitHub Actions

02Implementing verifiable package provenance for improved software supply chain security

03Troubleshooting failed npm publish steps in CI/CD pipelines

Tieline — product intent grounded in code

npm Trusted Publishing (OIDC)

Key Features

Use Cases

Next.js Turbopack Optimization

Pm2 Vps Release Guard

Network Config Validation

Key Features

Use Cases